Power BI Embedded Analytics
Embed interactive analytics in your applications, portals, and SaaS products. No per-user licensing for external users.
Founded 1997 · in our 30th year11,000+ enterprise engagementsMicrosoft Press bestselling author
Embed interactive analytics in your applications, portals, and SaaS products. No per-user licensing for external users.
Power BI Embedded lets developers embed interactive reports and dashboards directly inside any web application, customer portal, or ISV product. Two licensing models apply: App Owns Data (no per-user license required — best for external users) and User Owns Data (requires Pro/PPU — best for internal apps). EPC Group recommends App Owns Data for 80% of embedded scenarios.
Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group
Quick Answer: Power BI Embedded lets you add interactive analytics to custom applications. This integration does not require end users to have Power BI licenses.
There are two main patterns:
Pricing depends on Fabric capacity SKUs. For instance, F64 costs about $4,096 per month and allows unlimited external users.
EPC Group offers embedded analytics that include:
Embedded analytics changes Power BI from an internal BI tool to a customer-facing product feature. You can now embed production-grade Power BI visualizations directly in your application. This eliminates the need to export PDFs or create custom charting libraries.
With row-level security, each user will only see their own data.
EPC Group has implemented Power BI Embedded for ISV products, customer portals, healthcare applications, and financial dashboards. This guide covers architecture patterns, pricing optimization, and implementation best practices.
Embed analytics in a customer portal so clients can view their own data — usage analytics, performance metrics, billing dashboards. Clients do not need Power BI licenses.
Pattern: App Owns Data
Security: Dynamic RLS by customer/tenant ID
Pricing: F-SKU capacity (no per-user cost)
Embed Power BI analytics as a feature of your SaaS product. Each customer organization sees only their data. White-labeled with your branding.
Pattern: App Owns Data
Security: Multi-tenant RLS with TenantID filter
Pricing: F-SKU capacity, scales with customer count
Embed dashboards in internal line-of-business applications (HR portal, sales CRM, operations dashboard). Users authenticate with corporate Entra ID.
Pattern: User Owns Data
Security: Static RLS by user/group identity
Pricing: Power BI Pro or Premium Per User licenses
HIPAA-compliant embedded analytics showing patient health metrics, appointment history, and care plan progress. PHI protection via sensitivity labels and RLS.
Pattern: App Owns Data
Security: Dynamic RLS by patient/provider ID with HIPAA controls
Pricing: F-SKU capacity + compliance configuration
| SKU | Capacity Units | Monthly Cost (Reserved) | Best For |
|---|---|---|---|
| F2 | 2 CUs | ~$262 | Development and testing |
| F4 | 4 CUs | ~$524 | Small-scale dev/test |
| F8 | 8 CUs | ~$1,048 | Small production workloads |
| F16 | 16 CUs | ~$2,097 | Medium production |
| F32 | 32 CUs | ~$2,048 | Medium-large production |
| F64 | 64 CUs | ~$4,096 | Enterprise production (recommended) |
| F128 | 128 CUs | ~$8,192 | High-volume enterprise |
| F256 | 256 CUs | ~$16,384 | Large-scale ISV / SaaS |
Choose App Owns Data vs User Owns Data pattern. Design multi-tenant data isolation strategy. Plan capacity SKU based on concurrent user estimates.
Implement embed token generation on your server. Integrate Power BI JavaScript SDK into your frontend. Configure row-level security for data isolation per tenant.
Validate RLS with test accounts across multiple tenants. Load test concurrent embedded views. Verify token refresh and error handling.
Deploy to production with Azure Monitor integration. Set up capacity usage alerting. Monitor embed token generation performance and error rates.
| Factor | App Owns Data | User Owns Data |
|---|---|---|
| Authentication | Service principal — users don't need Power BI accounts | Each user authenticates with Entra ID |
| User Licensing | No per-user Power BI license needed | Each user needs Power BI Pro or PPU license |
| Best For | External-facing: customer portals, ISV products, public dashboards | Internal: employee-facing apps where users already have M365 |
| Data Security | Dynamic RLS via embed token with effective identity | Standard RLS based on user's Entra ID identity |
| Scalability | Scales to millions of external users on capacity | Limited by Power BI license count |
| Cost Model | Fabric capacity (F-SKU) — fixed monthly cost regardless of user count | Per-user licensing — cost scales linearly with users |
| EPC Recommendation | 80% of embedded scenarios — default choice | Only when users already have M365 E3/E5 licenses |
Power BI Embedded is a Microsoft service that allows developers to embed interactive Power BI reports, dashboards, and visuals directly into custom web applications, portals, and SaaS products. Unlike standard Power BI Service (where users navigate to powerbi.com), embedded analytics brings Power BI content into your own application UI — users interact with analytics without leaving your application and without needing individual Power BI licenses.
App Owns Data (service principal authentication): your application authenticates with a service principal — end users do NOT need Power BI licenses. Best for external-facing applications, ISV products, and customer portals. User Owns Data (interactive authentication): each user authenticates with their own Entra ID credentials and needs a Power BI Pro or Premium license. Best for internal applications where users already have M365 licenses. EPC Group recommends App Owns Data for 80% of embedded analytics scenarios.
Power BI Embedded pricing uses capacity-based SKUs: F2 (2 CUs): ~$262/month — development/testing. F8 (8 CUs): ~$1,048/month — small production workloads. F64 (64 CUs): ~$4,096/month (reserved) — enterprise production. F128 (128 CUs): ~$8,192/month — high-volume production. Legacy A-SKU (Azure-based): A1 ~$750/month to A6 ~$24,000/month. F-SKUs (Fabric) are recommended for new deployments. No per-user licensing for App Owns Data — the capacity serves unlimited external users.
Row-level security (RLS) in embedded analytics ensures each user only sees their data. Implementation: 1) Define RLS roles and DAX filters in the Power BI data model, 2) When generating embed tokens via the API, pass the effective identity (username + roles), 3) Power BI applies the DAX filter at query time, 4) Each user sees only their authorized data. For multi-tenant ISV applications, use dynamic RLS with a TenantID filter — each customer sees only their organization data. EPC Group implements RLS patterns that scale to millions of users across thousands of tenants.
Yes. Microsoft provides the Power BI JavaScript SDK and React wrapper (powerbi-client-react) for embedding. The React component handles token management, configuration, and event handling. Angular, Vue, and vanilla JavaScript applications use the core powerbi-client SDK. EPC Group has embedded Power BI in React/Next.js, Angular, ASP.NET, and custom SaaS platforms. The embedding process involves: generating embed tokens via the REST API (server-side), passing tokens to the client-side SDK, and configuring the embedded report with filters, page navigation, and event handlers.
The Power BI Embedded playground (playground.powerbi.com) is an interactive tool for testing embedded configurations before implementing in your application. You can experiment with: report embedding with different filter configurations, dashboard and tile embedding, Q&A embedding for natural language queries, paginated report embedding, and custom visual interactions. EPC Group uses the playground during design sessions with clients to prototype embedded experiences before development begins.
Schedule a free embedded analytics consultation. We will evaluate your application architecture and design an embedded Power BI solution with proper security, multi-tenancy, and performance optimization.
Power BI Embedded allows developers to integrate interactive reports and dashboards into any web application, customer portal, or ISV product.
There are two licensing models:
EPC Group recommends using App Owns Data for 80% of embedded scenarios.
| Factor | App Owns Data | User Owns Data |
|---|---|---|
| Authentication | Service principal (Entra ID app registration) | Entra ID — individual user login |
| End-user license required | No — capacity covers all viewers | Yes — Pro or PPU per user |
| Best for | External customers, ISV SaaS, customer portals | Internal apps, employee-facing dashboards |
| Row-level security | Effective identity passed in embed token | User's own Entra ID identity |
| Multi-tenant support | Yes — TenantID filter in RLS | No — single tenant only |
| EPC Group recommendation | ✓ Recommended for 80% of scenarios | Internal apps only |
Embedded analytics runs on capacity licensing, not per-user licensing (for App Owns Data). Choose the SKU that matches your concurrent user load and refresh frequency needs.
RLS restricts what data each embedded user sees. The implementation follows three steps regardless of report complexity.
[Region] = USERNAME()).effectiveIdentity parameter with the current user's identifier.For ISV products that serve multiple customer organizations, adding a TenantID column to your data model is essential. This TenantID must be part of the effective identity. Each customer's embedded session will only access their specific rows. All customers will share one capacity and one dataset.
Power BI Embedded uses the JavaScript SDK and a set of framework-specific wrappers. All are open-source and maintained by Microsoft.
Healthcare and financial services applications embedding Power BI need additional controls beyond standard RLS.
If you use the App Owns Data model, your application generates an embed token with a service principal. This allows end users to access the embedded report through your application.
They can do this without needing a Power BI license.
You will pay for capacity, which starts at approximately $262 per month. This capacity allows unlimited external viewers.
F-SKUs are the newer Microsoft Fabric capacity model. They are always-on and include Fabric features (Lakehouse, Data Factory, Real-Time Analytics) in addition to Power BI Embedded.
A-SKUs are the legacy Power BI Embedded model. They can be paused when not in use, which makes them cost-effective for development and testing.
EPC Group recommends using F-SKUs for new production deployments.
Add a TenantID column to your data model. Create a DAX RLS role that filters rows where TenantID equals the value passed in the effective identity.
When your application creates an embed token for a customer session, include the customer's TenantID in the effectiveIdentity parameter. This ensures that Power BI applies the filter at query time.
As a result, each customer will only see their own data rows.
The Playground at playground.powerbi.com is a free, interactive test environment for Power BI Embedded.
You can test report embedding and configure authentication. You can also generate code snippets for JavaScript, React, and Angular. Additionally, validate your token generation logic before writing application code. EPC Group uses this as the starting point for every embedded analytics project.
Yes, this is possible when set up correctly. Follow these steps:
EPC Group designs HIPAA-compliant embedded analytics architectures for healthcare clients.
EPC Group has successfully completed over 1,500 Power BI deployments. These include:
For more information, call (888) 381-9725, email contact@epcgroup.net, or schedule a Power BI Embedded architecture call.
AI assistant — not human