Power BI Embedded for ISVs: The Complete Guide to Pricing, Architecture, and Multi-Tenant Implementation

Power BI Embedded for ISVs: Complete Guide 2026

Last updated: 2026 · Read time: 12 min

Power BI Embedded gives ISVs (Independent Software Vendors) a way to embed interactive analytics directly into their commercial software. ISVs use the App Owns Data model with service principal authentication — end users never need Power BI licenses. This guide covers multi-tenant RLS, A/F-SKU pricing, embed token auth, and step-by-step implementation. Based on 200+ ISV projects.

Key facts

• EPC Group: 200+ Power BI Embedded ISV projects delivered.
• ISVs must use App Owns Data — not User Owns Data. End users of commercial software do not have Power BI licenses.
• Fabric F-SKU replaces the deprecated A-SKU for all new ISV Embedded deployments.
• Embed tokens expire after 1 hour — server-side token refresh is required for ISV applications.
• Row-Level Security is the only supported method for tenant data isolation in a shared workspace. Misconfigured RLS exposes one customer's data to another.

Why App Owns Data is the only ISV option

ISV applications sell to customers who do not have Power BI accounts. User Owns Data requires every viewer to authenticate with Azure AD and hold a Power BI license. That model works for internal enterprise apps — not for commercial software sold to external customers.

App Owns Data uses a service principal. Your application authenticates on behalf of all users. Users see reports without ever touching Power BI or Microsoft authentication.

Multi-tenant architecture options

ISVs must decide how to isolate customer data before building the Embedded architecture. Choose based on your compliance requirements and tenant count.

Option 1: Shared workspace with RLS (recommended for 50–10,000 tenants)

All tenant data lives in one dataset. Row-Level Security filters data based on the embedding user's tenant ID. One workspace, one dataset, one capacity — low management overhead.

• Efficient: one refresh pipeline for all tenants.
• Cost-effective: one Fabric capacity covers all tenants.
• Risk: RLS misconfiguration exposes data across tenants. Test RLS in every release.

Option 2: Isolated workspace per tenant (for regulated industries)

Each customer gets their own Power BI workspace and dataset. Required for HIPAA, SOC 2 Type II, and FedRAMP customers who have data isolation requirements.

• Complete data isolation — no cross-tenant risk.
• Higher management overhead — workspace automation required at scale (Azure DevOps + Power BI REST API).
• Higher cost — more capacity needed per tenant at equivalent concurrency.

Option 3: Hybrid (recommended for mixed compliance tiers)

Standard tenants use shared workspace + RLS. Premium or regulated tenants get isolated workspaces. This is the most scalable architecture for ISVs serving both SMB and enterprise customers.

Security layers for ISV Embedded deployments

ISV Embedded security requires all 6 layers below. Missing any one creates compliance or data leakage risk.

• Row-Level Security (RLS) — tenant data isolation enforced at the data engine level. Configured in the Power BI semantic model using DAX roles.
• Object-Level Security (OLS) — hides sensitive columns or tables from specific user roles. Independent of RLS.
• Embed token expiration — configurable, default 1 hour. Server-side token generation prevents client-side tampering.
• Azure Private Link — network-level isolation for regulated industries. Prevents Power BI traffic from traversing public internet.
• Customer-managed encryption keys (BYOK) — data-at-rest encryption with customer-controlled keys. Required for some HIPAA and FINRA deployments.
• Data residency controls — Azure region selection for capacity determines where Power BI stores data. Required for EU data sovereignty compliance.

ISV branding and UI customization

ISVs embed Power BI inside their own application UI. Users should not see any Power BI branding.

• Apply custom themes (colors, fonts, logos) using Power BI Desktop theme JSON files.
• Hide the Power BI navigation pane and action bar using JavaScript SDK settings.
• Embed reports in custom page layouts using the Power BI JavaScript SDK container configuration.
• Disable or customize the filter pane to match your application's UX.
• Control which user interactions are permitted: disable export, restrict drill-through, hide specific visuals.

Designing reports for embedded consumption

Reports embedded in an ISV application behave differently than reports viewed in the Power BI service. Design specifically for the embedded context.

• Test in the actual application container size — not the Power BI Desktop canvas.
• Use custom visual layouts for responsive design across different container dimensions.
• Implement bookmarks and report events for application-controlled navigation (no Power BI page tabs visible).
• Disable Power BI chrome elements (filter pane, page tabs) that conflict with your application's navigation.

Fabric F-SKU pricing for ISVs

Fabric F-SKU is the recommended capacity for ISV Embedded deployments. The A-SKU (Azure Embedded) is deprecated for new projects.

• F2 ($263/month) — up to 4 GB memory. Suitable for development and small-tenant pilot deployments.
• F4 ($526/month) — mid-market ISV deployment. Up to 50 concurrent users with standard report complexity.
• F8 ($657/month) — growing ISV with 100–200 concurrent users.
• F32 ($2,628/month) — large ISV with 500+ concurrent users. Supports Direct Lake mode.
• F64 ($5,257/month) — enterprise ISV scale. HIPAA Trusted Workspace. Copilot integration. Highest performance SLA.

ISV capacity costs scale with tenant growth. Build capacity right-sizing reviews into your quarterly financial planning.

Step-by-step implementation flow

Follow these 7 steps in order. Steps 1–4 are architecture and security. Steps 5–7 are development.

1. Register an Azure AD application for service principal authentication.
2. Create a Power BI workspace and assign the service principal as a Member or Admin.
3. Build the semantic model with RLS roles for tenant isolation.
4. Test RLS with Power BI Desktop "View as Role" feature — verify no cross-tenant data is visible.
5. Generate embed tokens server-side using the Power BI REST API (/GenerateToken endpoint).
6. Embed the report in your application using the Power BI JavaScript SDK.
7. Implement server-side token refresh — rotate tokens before the 1-hour expiration to maintain user sessions.

Frequently asked questions

Do my customers need Power BI licenses for Embedded?

No. In the App Owns Data model, your ISV capacity covers viewer access. End users see reports through your application without a Power BI account. Report authors (ISV employees who build reports) need Power BI Pro licenses.

How do I ensure one customer can't see another customer's data?

Configure Row-Level Security in the semantic model. Set a DAX role that filters data to the tenant ID passed in the embed token. Test every RLS role using "View as Role" in Power BI Desktop before deploying to Production. Run automated RLS validation in your CI/CD pipeline.

What is the embed token and how do I generate it?

The embed token is a JWT that grants access to a specific report with a specific user identity. Generate it server-side using the Power BI REST API (/GenerateToken). Pass the token to the client-side JavaScript SDK. Implement a server-side refresh endpoint to rotate tokens before they expire (default: 1 hour).

Can I use Power BI Copilot in my ISV Embedded application?

Yes, on Fabric F64+ capacity with Copilot enabled. Your end users can ask natural language questions about the embedded report data without a Microsoft 365 Copilot license. EPC Group configures Copilot in Embedded as part of ISV implementation engagements.

Schedule an ISV Embedded consultation

EPC Group has delivered 200+ Power BI Embedded projects for ISVs across healthcare tech, fintech, HR software, and supply chain platforms. Talk to an architect about multi-tenant design, RLS patterns, and capacity planning. Call (888) 381-9725 or request a 30-minute discovery call.