How to Use Power BI Embedded in Azure

Embedding interactive Power BI reports directly into your applications offers a seamless data experience for your users, keeping them within your ecosystem. Doing this professionally requires leveraging Power BI Embedded through Microsoft Azure, a dedicated service for white-labeling analytics. This guide walks you through setting up Power BI Embedded in Azure, explaining key concepts like service principals and reserved capacity, and showing you how to get your reports live in your own software.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What Is Power BI Embedded?

Power BI Embedded is a Platform-as-a-Service (PaaS) offering on Azure that allows you to integrate Power BI visuals, reports, and dashboards into your own web or desktop applications. It's designed for independent software vendors (ISVs) and developers who want to provide analytics to their end-users under their own brand, rather than sending them to powerbi.com.

The core benefit is that your users don't need their own Power BI licenses to view the embedded content. Your application authenticates with the Power BI service on their behalf, offering a truly integrated experience. This is different from simpler embedding methods where each user must have a Power BI Pro license.

Key Benefits of Power BI Embedded

• White-Labeling: You control the entire user experience. Your users interact with your application, not Power BI.
• No User Licensing: Under the most common model ("App Owns Data"), your end-users do not need individual Power BI licenses, which vastly simplifies user management and reduces costs.
• Full Control: The Power BI JavaScript SDK gives you deep programmatic control over the embedded reports, allowing you to manage filtering, bookmarks, page navigation, and more based on user actions in your app.
• Dedicated Resources: You purchase a dedicated capacity (think of it as a private server) in Azure, ensuring performance isn't impacted by other Power BI tenants.

Choosing Your Embedding Capacity and Model

Before you start embedding, you need to understand the two primary embedding models and the purchasing options available in Azure.

Solution 1: "Embed for Your Customers" (App Owns Data)

This is the main scenario for Power BI Embedded. In this model, your application effectively "owns" the data visualization layer. The flow looks like this:

1. A user signs in to your application.
2. Your application's backend authenticates itself with Power BI using a secure identity called a Service Principal.
3. The backend generates a temporary, single-use embed token and passes it to the frontend.
4. A seamless, interactive report appears inside your application's UI, rendered for the end user.

The end-user has no idea they are viewing a Power BI report and needs absolutely no Power BI account or license. This is the model this guide focuses on.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Solution 2: "Embed for Your Organization" (User Owns Data)

This model is used for embedding Power BI content into internal applications, like SharePoint or Microsoft Teams. Here, each user authenticates using their own credentials and must have a Power BI Pro or Premium Per User (PPU) license. While still useful for internal portals, it is not the primary use case for the dedicated "Power BI Embedded" capacity in Azure.

Getting Capacity: "A" SKUs in Azure

To use the "Embed for Your Customers" model, you need to purchase a dedicated resource block from Azure. These are known as "A" SKUs — for example, A1, A2, A3. Each tier provides progressively more compute memory and rendering power, allowing you to handle more concurrent report viewers.

One of the single greatest advantages of buying "A" SKUs through Azure is the ability to pause and resume your capacity. If your development team works 9-to-5, you can script it to pause the capacity every night and on weekends, saving you more than 70% of the cost compared to running it 24/7.

Step-by-Step: Setting Up Power BI Embedded in Azure

Here is the end-to-end process for setting up the infrastructure required for the "App Owns Data" model.

Step 1: Create an Azure Active Directory (AAD) Application

Your application needs an identity to authenticate with Power BI's APIs. This identity is called a Service Principal.

1. Navigate to the Azure Portal and search for "Azure Active Directory."
2. In the left-hand menu, select "App registrations" and then click "+ New registration."
3. Give your application a clear name (e.g., "AnalyticsApp Service Principal"). For supported account types, choose "Accounts in this organizational directory only."
4. Click "Register." You will be taken to the application's overview page. Copy the Application (client) ID and Directory (tenant) ID and save them. You'll need these later.
5. Now go to the "Certificates & secrets" tab. Click "+ New client secret," give it a description, choose an expiration period, and click "Add." Immediately copy this secret's Value. This is your application's password, and you won't be able to see it again after you leave this page.

Step 2: Create a Power BI-Enabled Security Group

Next, you create a security group in Azure AD and add your new app registration to it. This allows you to manage permissions within the Power BI Service via the group, which is a best practice.

1. In Azure Active Directory, go to "Groups" and click "+ New group."
2. Set the "Group type" to "Security."
3. Give it a name, like "Power BI Embedded Service Principals."
4. Once the group is created, open it, go to "Members," and click "+ Add members." Search for the name of the app registration you created in Step 1 and add it.

Step 3: Enable Service Principal Access in Power BI

You must tell your Power BI tenant that it's okay for applications (via service principals) to access its data and APIs.

1. Log in to Power BI as an administrator and go to the Admin portal: https://app.powerbi.com/admin-portal.
2. Click on "Tenant settings" and scroll down to the "Developer settings" section.
3. Find the setting "Allow service principals to use Power BI APIs." Enable it.
4. Select "Apply to: Specific security groups" and search for the security group you just created ("Power BI Embedded Service Principals"). This ensures only approved applications can access your Power BI tenant.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Step 4: Configure Your Power BI Workspace

Authenticated service principals don't get access to your entire Power BI tenant — only to specific workspaces you grant them access to.

1. In the Power BI service, create a new workspace or use an existing one that will hold the reports you want to embed.
2. Go into the workspace and click "Access" at the top.
3. Search for the name of your security group or your app registration and add it.
4. Assign it the role of Member, Contributor, or Admin. Member is usually sufficient for viewing content and using the APIs.

At this point, you've established a secure communication bridge between your external application and a specific workspace inside Power BI.

Step 5: Create a Power BI Embedded Capacity in Azure

Now it's time to purchase the actual compute resources that will render your reports.

1. In the Azure Portal, click "+ Create a resource" and search for "Power BI Embedded."
2. Click "Create" and fill in the details:
3. Click "Review + create" and then "Create."

Step 6: Assign the Workspace to Your Capacity

The final "plumbing" step is to link your Power BI workspace to the Azure capacity you just provisioned.

1. Go back to the Power BI service and into the workspace containing your reports.
2. Click the three dots and select "Workspace settings."
3. Navigate to the "Premium" tab.
4. Toggle on "Dedicated capacity."
5. You should see the capacity you created in Azure appear in the dropdown list. Select it and click "Save."

A diamond icon will now appear next to your workspace name, indicating that its content is being served by your Power BI Premium Embedded capacity.

High-Level View of Embedding the Report

With the infrastructure in place, the developer's work begins. This involves both backend and frontend code to securely request an embed token and render the report in your app.

Required Information for an Embed Request

Your client-side application will need three key pieces of information from your server:

• Report ID: The unique identifier of the report to embed.
• Embed URL: The base URL needed to render the content.
• Embed Token: A short-lived access token generated by your backend using the Service Principal. This token grants the end-user limited, one-time access to view a specific report.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Example Frontend JavaScript using the powerbi-client SDK

On your frontend, you'll use the official Power BI JavaScript library (powerbi-client) to render the report. The user's browser makes a call to your server to get the embedding details, and then POWER BI-client handles the rest.

Here's a simplified pseudo-code snippet illustrating the concept:

// Import the necessary powerbi-client models.
import { models } from 'powerbi-client',

async function embedReport() {
  // 1. Get embedding data from YOUR server's secure endpoint.
  // This endpoint uses the service principal to talk to the Power BI API.
  const embedConfigFromServer = await fetch('/api/getEmbedToken'),
  const embedConfig = await embedConfigFromServer.json(),

  // 2. Prepare the configuration object for the client.
  const config = {
    type: 'report',
    tokenType: models.TokenType.Embed,
    accessToken: embedConfig.accessToken,
    embedUrl: embedConfig.embedUrl,
    id: embedConfig.reportId,
    settings: {
      panes: {
        filters: { expanded: false, visible: false },
        pageNavigation: { visible: false }
      }
    }
  },

  // 3. Find the HTML container where the report should go.
  const reportContainer = document.getElementById('reportContainer'),

  // 4. Embed the report using the powerbi.embed function.
  const report = powerbi.embed(reportContainer, config),
}

Your backend is responsible for housing the secure credentials (Client ID, Client Secret) and performing the service principal authentication to communicate with the Power BI REST API and generate the embed token.

Final Thoughts

Power BI Embedded in Azure is the definitive way to build enterprise-grade applications with integrated, white-labeled analytics. By setting up a service principal for authentication and associating your workspaces with a dedicated Azure capacity, you create a scalable and secure pipeline for delivering data insights directly to your users, inside the applications they use every day.

Setting up a custom embedded analytics solution is a powerful but involved process that requires significant backend and frontend development. If your goal is simply to unify your business data and get fast insights without a large engineering investment, a different approach might be faster. We created Graphed to be the simplest way to get real-time answers from your business data. Just connect your platforms like Google Analytics, Shopify, Facebook Ads, or HubSpot, and use plain English to ask questions and build the exact dashboards you need in seconds.