TL;DR
Power BI Embedded is Microsoft’s Azure service for putting interactive Power BI reports and dashboards inside your own app or website. You pay for capacity rather than per viewer, starting at about $1.01 an hour for an A1 node at US East list price. When your app owns the data, customers who view the reports need no Power BI license. When employees sign in with work accounts, each viewer needs Pro or PPU unless the content sits on an F64 or larger capacity. Choose an A SKU for a pausable customer-facing app, and a Fabric F SKU when internal users or other Fabric workloads share it. Security is built on your server, through a scoped embed token, row-level security and tests proving one tenant cannot see another’s data.
Key Takeaways Power BI Embedded is an Azure capacity offer (A SKUs) for showing Power BI content inside your own application. With app owns data, external viewers need no Power BI license, while user owns data needs one per viewer below F64. A SKUs start at about $1.01 per hour in US East, bill to the second and stop charging while paused. Fabric F SKUs cost $0.18 per capacity unit-hour and are the path for teams that also serve internal users at scale. Microsoft has stopped selling new Premium P SKUs, so new buyers choose between A and F capacity. Access is enforced on the server through the embed token, effective identity and row-level security, never through browser filters. Watch on YouTube
Rayfin vs Fabric Apps vs Power BI vs Power Apps: Which Microsoft Tool Fits the Job?
Kanerika compares Microsoft’s app and analytics tools side by side, a useful first step before deciding that embedded Power BI reports are the right way to put analytics in your product.
The Sprint Where a Product Team Decides to Embed Analytics
Picture the planning meeting at a B2B software company that sells scheduling tools to clinics (an illustrative, anonymized scene). Customers keep asking for usage dashboards, and the data team already builds those reports in Power BI for internal use. So the product manager asks the obvious question. Can the same reports appear inside the app, behind each customer’s own login?
They can, and the first demo takes an afternoon. Then the harder questions arrive. First, who pays for each viewer? Second, how does one clinic stay out of another clinic’s numbers? And finally, will the capacity bill climb every time a new customer signs up?
Power BI Embedded answers all three. It only does so cleanly, though, when the embedding model, the capacity and the tenant design are chosen on purpose rather than discovered after launch.
What Is Power BI Embedded?
Power BI Embedded is an Azure offer that lets developers and software vendors place Power BI reports, dashboards, tiles and Q&A inside their own applications. Microsoft sells it as A SKUs, which are capacity nodes you rent by the hour, according to its Power BI embedded analytics overview . Your app talks to Power BI through the REST API and a JavaScript client library. As a result, the report renders inside your page, with your own branding around it.
The wider platform is covered in Kanerika’s Power BI guide . This post, however, stays on one job, which is getting Power BI content in front of people who never open the Power BI service. Still choosing between Microsoft’s app-building tools? Then the comparison of Rayfin, Fabric Apps, Power BI and Power Apps sorts out which tool fits which job.
Power BI Embedded vs the Power BI Service
In the Power BI service, people sign in to Microsoft’s portal, browse workspaces and open reports there. With Power BI Embedded, the report lives inside your product instead. In fact, your users may never know Power BI is behind the chart, and they never need a Microsoft account when your app owns the data.
Three capacity types can host embedded content. Power BI Embedded sells A SKUs through Azure. Power BI Premium offers P and EM SKUs through Microsoft’s Office licensing, though new P SKUs are no longer sold, while Microsoft Fabric sells F SKUs through Azure. All three run the same reports, so the choice comes down to billing, licensing and what else the capacity must carry.
Power BI Report Server, the on-premises edition, sits outside all three. It runs on your own servers, so it also follows a different licensing path from any cloud capacity.
What You Can Embed and What Users Can Do
You can embed whole reports, single visuals, dashboards, dashboard tiles and the Q&A experience. Viewers can also filter, slice and drill as they would in the service. Your front-end code also controls the filter pane, page navigation and layout, so the report can match the rest of your product.
Three Ways to Put a Power BI Report on a Page
Power BI gives you three different routes to a report on a web page, and they differ most on who can see the data. The table therefore compares them on the points that usually decide the choice.
Factor Secure embed Publish to web Power BI Embedded (app owns data) Who can view People in your organization with access Anyone with the link or page Your app’s signed-in users Sign-in Microsoft Entra ID None Your app’s own login Viewer license Pro or PPU, or free users on F64 or Premium None None Data exposure Only what each user may already see The whole report, including detail data, is public Only what the embed token and RLS allow Best fit Intranets and internal portals Public data with nothing confidential Customer-facing apps and partner portals
Publish to web deserves a firm warning. Microsoft says anyone on the internet can view a report published this way, with no authentication. It also tells authors never to publish confidential or proprietary information through it. So treat it as a channel for public statistics, never as a customer portal.
How Power BI Embedded Works
Every embedded report has the same moving parts. Your app and its backend sit on one side. Microsoft Entra ID, a Power BI workspace, the semantic model and a capacity sit on the other. If Entra ID is new to your team, Kanerika’s guide to Azure identity management covers the basics.
The App-Owns-Data Token Flow, Step by Step
A customer-facing request moves through six steps, and only the last one touches the browser.
A user signs in to your app with whatever login your product already uses. After that, your backend checks which customer, or tenant, the user belongs to and which reports they may open. The backend then authenticates to Microsoft Entra ID with a service principal and receives an access token that expires after an hour. Then the backend calls the Power BI REST API to generate an embed token scoped to that report, that semantic model and that user’s identity. Next, the browser receives the embed URL, the report ID and the embed token, then renders the report with the JavaScript client. Finally, the app renews tokens before they lapse and shows a clear message when a call fails. Two tokens do different jobs here. First, the Entra token proves your backend’s identity to Power BI and never leaves the server. The embed token, by contrast, tells Power BI which content one user may see. Microsoft’s page on embed tokens explains how the first produces the second.
So the browser only ever holds a short-lived embed token. Client secrets, certificates and the service principal’s credentials stay on your server, which is exactly where a security reviewer will look first.
Service Principal vs Master User
In embed for your customers, users never sign in to Entra ID. Instead, your web app uses a reserved Entra identity, which can be a service principal or a master user. A master user is a real account with a password, so service principals are the safer default for production.
Setting one up takes five moves in Microsoft’s service principal guide . First, you create an Entra app with an ID and a secret and put it in a security group. Then you enable the Power BI admin settings, add the app to the workspace and embed the content. The two tenant settings to switch on are “Embed content in apps” and “Allow service principals to use Power BI APIs”. Both sit under Developer settings in the admin portal.
Embed for Your Customers vs Embed for Your Organization
Microsoft splits Power BI embedded analytics into two solutions, and the choice changes identity, licensing and features at once. Choose the model before anyone writes code, because switching later means rebuilding authentication.
Factor Embed for your customers Embed for your organization Also known as App owns data User owns data Audience External users such as customers, partners and suppliers Internal users How users sign in Your app’s own authentication Microsoft Entra ID Viewer license None Each user needs a Power BI license (free users only on F64 or larger) Identity Power BI sees A service principal or master user The signed-in user R and Python visuals Not supported Supported, with region restrictions
App Owns Data, Analytics for Customers and External Users
This is the classic software-vendor pattern and the main reason people search for Power BI Embedded. Your customers log in to your product, your backend then generates the embed token, and nobody outside your company needs a Power BI license.
You pay for capacity instead, which turns analytics into a feature you can price into your own plans. Teams that plan to charge for those dashboards should read Kanerika’s take on data monetization strategy before setting prices.
User Owns Data, Analytics for Employees
Here, employees open an internal app and sign in with their work account, so Power BI sees the real user. That keeps permissions simple, because each person’s existing access applies. The catch is licensing, since each viewer needs Pro or PPU unless the content sits on an F64 or larger capacity.
Kanerika Service
Power BI Consulting and Implementation
Kanerika designs Power BI semantic models, security and embedding layers for customer-facing and internal apps, from the first token flow to production support.
Explore Power BI Services How to Choose, and Who Needs a Pro License
Whether an embedded report needs a Pro license depends on the model. With app owns data, for instance, viewers need no license at all. With user owns data, however, every viewer needs Pro or PPU on an A SKU or any F SKU below F64. Microsoft’s capacity and SKU guide spells this out.
Authors are the exception in both models. Publishing to a workspace needs Pro or PPU, although a service principal can publish through the REST API’s Post Import In Group call instead.
Mixed audiences are common in practice. For example, a partner portal might serve outside partners through app owns data and account managers through user owns data. So many teams run both models against the same semantic models.
Power BI Embedded Pricing and Licensing
Power BI Embedded is billed as capacity, so the bill depends on node size and running hours rather than on how many people view reports. For that reason, the Power BI pricing page lists Embedded as “Variable” instead of a per-user price.
A SKU Prices per Hour and per Month
The table shows pay-as-you-go list prices for US East, taken from Microsoft’s Azure retail price feed in November 2026. Monthly figures also assume 730 running hours. Prices vary by region and currency, so confirm yours on the Power BI Embedded pricing page or in the Azure calculator.
SKU V-cores RAM Price per hour About per month (730 h) F SKU equivalent A1 1 3 GB $1.01 $736 F8 A2 2 5 GB $2.01 $1,466 F16 A3 4 10 GB $4.02 $2,938 F32 A4 8 25 GB $8.06 $5,881 F64 A5 16 50 GB $16.12 $11,768 F128 A6 32 100 GB $32.25 $23,543 F256
A7 and A8 also exist for very large workloads. No US East price was listed for them at the time of writing, so check the calculator if you need that scale.
Billing per Second, With Pause and Resume
Microsoft bills A SKUs hourly with no commitment, but actual usage is computed to the second. So twelve hours and fifteen minutes is billed as 12.25 hours, and six minutes as 0.1 hour. While the capacity is paused you are not charged, and embedded content will not load.
As a result, pausing is the biggest cost lever you have. For example, development and test capacities can stop overnight. Even a production app used only in business hours can also follow a schedule, as long as nobody expects reports at 2 a.m.
Who Needs a License: Authors, Viewers and Developers
Capacity covers viewers in the app-owns-data model, yet some people still need per-user licenses. Power BI Pro costs $14 per user per month and Premium Per User costs $24, both paid yearly. Report authors need one of them, and so do internal viewers in a user-owns-data app below F64.
For the full per-user comparison, see Kanerika’s breakdown of Power BI Premium vs Pro .
Free Trial Tokens for Development
Developers can still start without buying capacity. With a Pro license, free embed trial tokens work for development testing, but never for production. Until you buy capacity, embedded reports also show a “Free trial version” banner.
Power BI Embedded vs Fabric Capacity vs Premium: Which Capacity to Buy
What Changed When P SKUs Started Retiring
Microsoft is retiring Power BI Premium per-capacity P SKUs . First, it no longer sells new ones. In addition, each subscription ends with its current agreement term, after which customers move to Fabric F SKUs. Embedded licenses are not part of the retirement, so A and EM SKUs stay on sale.
Every F SKU also covers embedded scenarios. So a team already on Fabric does not need a separate A SKU to embed reports. As a result, older guides that still point software vendors at P1 are now out of date.
A SKU vs F SKU Side by Side
For a Power BI Embedded buyer, then, the real choice is now between A and F capacity. So the comparison below covers the factors that change the bill or the architecture.
Factor A SKU (Power BI Embedded) F SKU (Microsoft Fabric) Billing Hourly, no commitment, pausable Pay-as-you-go at $0.18 per capacity unit-hour, or a 1- or 3-year reservation Example price, US East A4 at $8.06 per hour F64 at $11.52 per hour (about $8,410 a month) Free viewers for internal users No, each internal viewer needs Pro or PPU Yes, on F64 and above Embed for your customers Yes Yes Teams, SharePoint and PowerPoint Yes Yes Secure URL embedding from the service No Yes Other Fabric workloads No Yes US government GCC Not offered there (only EM and P are) Not supported
At pay-as-you-go rates, A4 costs about 30% less per hour than F64 for the same eight v-cores. A Fabric reservation saves about 41%, though, which brings F64 below the A4 hourly rate when the capacity runs around the clock.
Rules of Thumb for Choosing
The deciding question is who views the reports. If the audience is only customers inside your product, an A SKU is often the cheapest fit, because it pauses and bills by the second.
Talk to Kanerika
Plan Your Power BI Embedded Architecture
Kanerika reviews your audiences, embedding model, tenant design and capacity options, then gives you a clear plan for putting Power BI reports inside your app.
Schedule a Demo → Once employees also need those reports in volume, the math shifts. Below F64, each of them still needs Pro or PPU. So a large internal audience can make F64 or above cheaper than an A SKU plus licenses. Similarly, teams already running lakehouses or pipelines on Fabric usually embed from the F capacity they have.
The Microsoft Fabric vs Power BI comparison also explains what else an F capacity carries. Kanerika’s overview of Microsoft Fabric architecture then shows how those workloads share it.
How to Set Up Power BI Embedded Step by Step
A production setup is mostly decisions and ownership, with a modest amount of code. These six steps therefore follow the order in which problems tend to surface.
Step 1: Define Audiences, Tenants and Data Boundaries
First, list who will view reports, how they sign in and which customer each belongs to. The deliverable, then, is a short design note naming the embedding model, the tenancy approach and the data each audience may see.
Step 2: Build and Validate the Semantic Model and Reports
Embedded reports expose every modeling shortcut to paying customers, so build the semantic model with care first. Next, reconcile the measures against the source system, trim unused columns and test with realistic volumes. Kanerika’s Power BI data modeling best practices cover the habits that keep models small and fast.
Step 3: Register the App, Service Principal and Tenant Settings
Create the Entra app registration, add the service principal to a security group and grant it workspace access. Then ask a Power BI admin to enable the two developer tenant settings for that group only, rather than for the whole organization.
Step 4: Create the Capacity in the Azure Portal and Assign Workspaces
Create the A or F capacity in the Azure portal, in the region closest to your data and users. Then assign the production workspace to it, and keep development and test in separate workspaces. Power BI deployment pipelines help move content between those environments without manual copying.
Step 5: Generate Embed Tokens and Integrate the JavaScript Client
Your backend exposes one endpoint that checks the user, calls the token API and returns the embed details. The front end then passes them to the Power BI JavaScript client, which you can try first in Microsoft’s Power BI Embedded Analytics Playground. A minimal configuration looks like this.
// Values come from your backend token endpoint
const config = {
type: "report",
id: reportId,
embedUrl: embedUrl,
accessToken: embedToken, // short-lived embed token only
tokenType: models.TokenType.Embed,
settings: { panes: { filters: { visible: false } } }
};
const report = powerbi.embed(reportContainer, config);Hiding the filter pane only tidies the layout; it restricts no data, as the security section explains.
Step 6: Test, Release and Own Operations
Test token renewal, error handling, slow networks and, above all, cross-tenant access before launch. After release, name an owner for capacity, tokens and model refreshes, because embedded analytics is now part of your product’s uptime.
Security and Multi-Tenant Design
Security in Power BI Embedded is enforced on the server, at the moment the embed token is created. In other words, whatever the token allows, the browser can show. So the design question is how each token gets scoped to one customer’s data.
Row-Level Security With Effective Identity
Row-level security (RLS) filters rows by role, and with app owns data your backend passes an effective identity inside the embed token. Microsoft’s embedded RLS documentation notes that assigning users to roles in the Power BI service has no effect when an embed token is used. Instead, the identity you supply decides which rows appear, even though RLS normally skips workspace admins, members and contributors.
Kanerika’s guide to Power BI row-level security also walks through the roles and DAX filters behind this.
One Shared Semantic Model or One per Customer?
Microsoft’s current multitenancy guidance says new solutions should start with a dedicated service principal per customer. Service principal profiles still work, but they do not create an independent Entra identity or a cryptographic boundary between customers. The other common pattern, by contrast, is one large model with RLS, which suits vendors with relatively few customers and small to medium models.
Factor One shared model with RLS One model per customer Isolation Logical, and only as good as the RLS rules Stronger, with separate items per customer Maintenance One model to change and refresh Many models to deploy and refresh Customization Same model for everyone Per-customer changes are possible Scale Few customers, small to medium models Many customers or large data volumes Running cost Fewer items and less capacity overhead More refreshes and more memory
Neither design guarantees isolation by itself, as Microsoft states plainly. That is why a negative test, where a user from tenant A tries to load tenant B’s data and fails, belongs in every release. The wider design patterns are also covered in Kanerika’s guide to multi-tenant architecture .
Filters Are Not Security
Filters, slicers and URL parameters set in the browser can be changed by anyone with developer tools. They shape the view, yet they never restrict access. Only the embed token’s identity, RLS and workspace permissions do that, which is the same principle behind zero-trust data security .
Watch on YouTube
End-to-End Microsoft Power BI Implementation and Migration with Kanerika
See how Kanerika runs a Power BI program from data modeling through deployment and handover, the same production discipline an embedded rollout needs.
Treat the token service like any other sensitive API, too. In practice, log every token request with the user and tenant, rate-limit it and review its permissions, following standard SaaS security best practices .
Capacity Sizing and Performance
Size for Concurrent Workload, Not Registered Users
Ten thousand registered users who log in once a month need far less capacity than five hundred who all open dashboards at 9 a.m. Microsoft publishes peak renders per hour for each SKU, but it calls that figure sizing guidance rather than a licensing or throttling limit. Instead, concurrency, model size and visual complexity decide the real load.
Measure Before You Buy
Microsoft’s capacity planning guidance runs in four steps. First, optimize the model’s performance and memory footprint. Next, pick the minimum SKU that fits, assess the load, then set up autoscale.
Memory limits apply per item, so on an F64 a single semantic model is capped at 25 GB. For the load test itself, Microsoft points to the Power BI Capacity Load Assessment Tool on GitHub. Test with up to a few dozen simulated users, then extrapolate and watch the Microsoft Fabric Capacity Metrics app while it runs.
Autoscale and Pause Schedules
Scale up before known peaks, such as month-end reporting, and scale back down afterward. Then pair that with a pause schedule for non-production capacities, and the bill starts to track real use. When something does go wrong, the symptom usually points to the cause.
Symptom Likely cause What to check Visuals slow down during the working day Refreshes competing with report queries Refresh schedule and the Capacity Metrics app Throttling at peak hours Capacity too small for concurrent load Load test results and scale-up rules Errors about an hour into a session No token renewal in the front end Token refresh logic and expiry handling Blank reports with no clear error Capacity paused or workspace unassigned Capacity state in the Azure portal Slow first load for each customer Large model or heavy report pages Model size and visual count per page
Nearly all of these show up in the first week of a pilot. So run the load test before customers do it for you.
Power BI Embedded Use Cases and Examples
Customer-Facing SaaS Analytics
A software vendor shows each customer its own usage, billing and performance dashboards inside the product. This pattern runs on app owns data with an A or F SKU. Because customers share that capacity, the main risk is cross-tenant leakage. Teams building the product itself can see how Kanerika approaches SaaS product development .
Checklist
Power BI Best Practices Checklist
Check modeling, performance, security and governance on the Power BI models behind your embedded reports before customers start opening them.
Get the Checklist → Partner, Supplier and Franchise Portals
Distributors, franchisors and manufacturers, for example, share sell-through, inventory or service metrics with outside partners. The model is again app owns data, usually with RLS keyed on a partner ID. Here the risk is a partner hierarchy that the RLS rules fail to mirror, which clear data access governance settles before the model encodes it.
Internal Apps, SharePoint and Teams
Employees see reports inside a line-of-business app, a SharePoint page or a Teams tab. The Power BI web part for SharePoint Online , in particular, needs modern pages and a signed-in user. Free users can view only on F64 or Premium capacity.
So the risk here is a licensing surprise rather than a data leak. This is also where many self-service business intelligence programs begin.
SAP-Backed Operational Dashboards
Many embedded dashboards report on SAP orders, inventory or finance data. Power BI cannot embed what has not reached a semantic model, so extraction and modeling come first as a separate workstream. Kanerika’s guides to SAP data integration and SAP Business Data Cloud explain how that data leaves SAP in usable shape.
Copilot in Embedded Reports
Copilot’s narrative visual can be embedded for user owns data, secure embed and the SharePoint web part. For app owns data it is still in preview as of late 2026, so customer-facing apps should not promise it yet. For what Copilot does inside reports, see Kanerika’s guide to Power BI Copilot .
Power BI Embedded Production-Readiness Checklist
A launch review goes faster with a short go or no-go list. Each item below should have a named owner and evidence behind it.
Identity and Access
A service principal is in use, and no master user remains. Client secrets live in a vault, never in browser code. Embed tokens are scoped to one report, one model and one effective identity. Tenant settings are enabled for a security group, not the whole organization. Data and Performance
Measures are reconciled against the source system. RLS roles are tested for every tenant type. A load test has run at expected peak concurrency. Refresh windows sit outside peak viewing hours. Release and Operations
The negative cross-tenant test has passed. Token renewal and error messages are tested. A capacity owner, alert rules and a pause schedule are in place. Support has a runbook for “report won’t load” tickets. Five findings should stop a release outright. Above all, watch for credentials in browser code and a failed cross-tenant test. Unreconciled metrics, no named owner and missing token renewal also mean the app is not ready, however good the demo looked.
When Power BI Embedded Is the Wrong Choice
Power BI Embedded suits most customer-facing analytics in a Microsoft environment. Even so, four situations call for a different route.
Public data with nothing confidential. Publish to web is free and simpler, as long as the whole report can be public.Internal users who already hold licenses. Secure embed or the SharePoint web part puts a report on an intranet page with no capacity purchase.Customer apps that need R or Python visuals. App owns data does not support them, so these visuals only work in internal, user-owns-data apps.US government GCC tenants that want Fabric. F SKUs are not supported there, so plan around EM or P.Some organizations also need reports to run on their own servers rather than in Azure. That need points instead to Power BI Report Server, the on-premises edition mentioned earlier.
Other embedded BI products exist too, such as Tableau Embedded, Looker and Sisense. Kanerika’s review of Tableau alternatives compares the wider BI field. For pixel-perfect statements and print layouts, its guide to enterprise reporting tools covers the options.
How Kanerika Delivers Power BI Embedded Projects
Kanerika is a Microsoft Solutions Partner for Data and AI and holds Microsoft’s Analytics on Microsoft Azure specialization. Its Power BI consulting services cover modeling, governance and delivery, and embedding work follows five stages that mirror the risks in this guide.
First, assessment settles the audience, the embedding model, the tenancy design and a first capacity estimate. Design then fixes the semantic model, the RLS and effective identity rules, and the per-customer service principal approach. After that, the build delivers the token service, the JavaScript integration and the error handling.
Next, load testing sizes the capacity against real concurrency before customers arrive. Finally, governance and handover give the client named owners, runbooks and a pause and scale plan. Teams that want extra hands can also hire a Power BI developer , or compare partners in Kanerika’s list of Power BI consulting companies .
Proof From a Recent Power BI Program
The modeling discipline behind this shows in a recent Power BI program. For a multinational pharmaceutical company operating in more than 50 countries, Kanerika moved reporting from Tableau to Power BI. The pharma case study reports a 30% cut in BI-related costs and a 45% rise in operational performance.
That was a platform move, however, rather than an embedding project. Still, reconciled semantic models like those are exactly what an embedded app depends on. And where existing customer dashboards sit in Tableau or Qlik, FLIP , Kanerika’s migration accelerator, converts them to Power BI before embedding begins. The Qlik Sense to Power BI migration datasheet lists what FLIP automates, from metadata and logic mapping to data connections and validation.
Case Study
30% Lower BI Costs for Pharma with Tableau to Power BI
For a multinational pharmaceutical enterprise operating in 50+ countries, Kanerika moved reporting from Tableau to Power BI, cutting BI-related costs by 30% and raising operational performance by 45%.
Read the Case Study → Power BI Embedded is the right choice when your app owns the data and you want customers to see Power BI reports without licenses. Start with an A SKU you can pause, and move to F64 or larger once internal viewers multiply. Ship only after the cross-tenant test passes. If you want a second pair of eyes on the design, talk to Kanerika’s Power BI team .
Frequently Asked Questions
What is Power BI Embedded used for?
Power BI Embedded is used to show interactive Power BI reports, dashboards and visuals inside your own application, website or portal. Software vendors use it for customer-facing analytics, and companies use it for partner portals and internal line-of-business apps. Your app handles sign-in, while Power BI renders the reports with your branding around them.
How much does Power BI Embedded cost?
Power BI Embedded is priced per capacity node, not per viewer. At US East pay-as-you-go list prices, an A1 node costs about $1.01 per hour, around $736 a month if it never stops, and an A4 costs about $8.06 per hour. Usage is computed to the second, so pausing the capacity cuts the bill.
Is Power BI Embedded free?
Power BI Embedded is not free in production. Developers with a Pro license can use free embed trial tokens for development testing, but those tokens are not meant for live apps. Until you buy an A or F capacity, every embedded report also shows a Free trial version banner across the content your users see.
Do users need a Power BI Pro license to view embedded reports?
It depends on the embedding model. With embed for your customers, also called app owns data, viewers need no Power BI license. With embed for your organization, each viewer needs Pro or Premium Per User unless the content sits on an F64 or larger capacity. Report authors always need Pro or PPU to publish.
What is the difference between Power BI Embedded and Power BI Premium?
Power BI Embedded is an Azure offer with hourly A SKUs and no commitment, built mainly for embedding in your own apps. Power BI Premium sold P and EM SKUs through Microsoft’s Office licensing. Microsoft has stopped selling new P SKUs and is moving those customers to Fabric F SKUs, while A and EM SKUs continue.
Can Power BI Embedded use Microsoft Fabric capacity?
Yes. Every Fabric F SKU covers embedded scenarios, so you can embed Power BI content from an F capacity without buying a separate A SKU. Fabric costs $0.18 per capacity unit-hour at US East list price, which puts F64 at about $11.52 per hour. F64 and above also let free internal users view content.
Is Power BI Embedded secure?
Power BI Embedded is secure when access is enforced on the server. Your backend keeps the service principal secret, issues a short-lived embed token scoped to one user’s identity, and applies row-level security. Browser filters never restrict data. Microsoft also advises per-customer service principals for new multitenant apps and testing cross-tenant isolation before release.
Can I embed Power BI in a website or SharePoint?
Yes, in three ways. Publish to web puts a report on any public website, but anyone can see it without signing in. The SharePoint Online web part embeds reports for signed-in staff on modern pages. Power BI Embedded puts reports inside your own web app behind your own login, with no viewer licenses needed.
Does Copilot work in Power BI Embedded?
Partly. The Copilot narrative visual can be embedded for user owns data, secure embed and the SharePoint web part. For app owns data, the customer-facing model, it is still in preview as of late 2026. Customer-facing apps should therefore treat Copilot as an early feature to test, not one to promise in contracts.
What is the difference between an Entra token and an embed token?
A Microsoft Entra token proves your backend’s identity to the Power BI REST API, and it expires after an hour. Your backend uses it to generate an embed token, which tells Power BI exactly which report, semantic model and user identity one viewer may access. Only the embed token ever reaches the browser.
