Power Pages Adds Power BI Embed Token v2 for Paginated Reports and Data Lake Models

Why does an authentication token version number matter so much to low-code developers and Windows enterprise administrators? Because in the Power BI ecosystem, the token generator dictates the entire architecture of what your web portal is allowed to render.

From V1 Bottlenecks to V2 Enterprise Analytics​

Historically, Power Pages relied on version 1 of the Power BI GenerateToken API to handle "embed for your customers" (app-owns-data) scenarios. As Microsoft Learn’s Power Pages troubleshooting documentation explicitly points out, whenever an embedded item required version 2 of the GenerateToken API, the portal failed to render the visualization and threw an error stating: "Couldn't load the model schema associated with this report."

By bringing Power BI Embed Token v2 support into the Power Pages design studio, Microsoft has unlocked three vital enterprise reporting capabilities that were previously off-limits without writing custom server-side token broker code:

• Paginated (RDL) Reports: Makers can now embed pixel-perfect, SQL Server Reporting Services-style paginated reports—such as invoices, compliance statements, and operational ledgers—including those that rely on Power BI datasets as a data source or require multi-resource tokens.
• Data Lake–Backed Semantic Models: Reports built on semantic models utilizing Data Lake Storage (DLS) can now be embedded. Microsoft Learn’s Power BI developer documentation confirms that embedding items using DLS strictly requires v2 of the GenerateToken API so that both dataset and identity permissions can be bundled into the token.
• Multi-Artifact Embedding: Instead of minting a separate, single-item token for every isolated view, a single v2 embed token can grant access to multiple reports and datasets simultaneously, allowing makers to build cohesive, app-like analytics experiences inside a Power Pages site.

To take advantage of these scenarios, makers must explicitly select and configure Embed Token v2 when setting up Power BI embedding within their Power Pages sites.

Summary: What Changed in Power Pages​

• Roadmap Item: 576793 (Launched; July 2026 General Availability for Worldwide Standard Multi-Tenant).
• Core Upgrade: Power Pages design studio now supports Power BI Embed Token v2 for site configurations.
• Unlocked Workloads: Paginated (RDL) reports, Data Lake Storage–backed semantic models, and multi-resource report/dataset tokens.

Under the Hood: How Embed Token v2 Works​

To appreciate what Power Pages is now handling behind the scenes, it helps to look at how Microsoft’s Power BI REST APIs structure a version 2 token request (GenerateTokenRequestV2). According to Microsoft Learn’s REST API reference, the v2 GenerateToken endpoint (POST [url]https://api.powerbi.com/v1.0/myorg/GenerateToken[/url]) is designed specifically for the "embed for your customers" scenario and can package up to 50 reports, 50 datasets, and 50 target workspaces into a single token call, provided all artifacts reside in V2 workspaces.

When a paginated report uses one or more Power BI semantic models as its data source—or when a standard Power BI report uses a DirectQuery connection chained to another Power BI semantic model—a simple report ID is not enough. Because a paginated report can pull from multiple semantic models simultaneously, Power BI cannot infer the data source from a single datasetId property. Instead, as documented in Microsoft Learn’s paginated report embedding guide, the v2 token request must include a GenerateTokenRequestV2Dataset object for every underlying semantic model, with xmlaPermissions explicitly set to ReadOnly and the report’s allowEdit flag set to false.

Wait—does this mean every Power BI artifact now runs on v2 tokens? Not quite. Microsoft Learn’s developer documentation notes that the v2 GenerateToken API applies specifically to reports and semantic models. If you are embedding legacy Power BI dashboards or individual dashboard tiles, Power BI still relies on the v1 Dashboards GenerateTokenInGroup and Tiles GenerateTokenInGroup APIs, which only generate tokens for one item at a time.

The Admin and Maker Playbook: Prerequisites and Pitfalls​

Before you promise your finance department that their multi-page RDL billing statements will be live on the customer portal before lunch, you need to navigate the infrastructure and security requirements that govern Power BI Embedded in Power Pages. Supporting a v2 token in the design studio removes the portal’s API bottleneck, but it does not bypass Power BI’s strict workspace, capacity, and identity rules.

1. Tenant, Workspace, and Service Principal Rules​

According to Microsoft Learn’s Power Pages administration guides, enabling Power BI visualization and the Power BI Embedded service happens in the Power Platform admin center (under Resources > Power Pages sites > Manage). Toggling either setting restarts the website and takes it offline for several minutes, so schedule initial setup outside peak business hours.

Furthermore, admins must create a Microsoft Entra ID security group (commonly named Power Pages Power BI Embedded service), add the website’s application ID as a member, and authorize that security group in the Power BI Admin portal under Tenant settings > Developer settings by enabling both Embed content in apps and Service principals can call Fabric public APIs (formerly Allow service principals to use Power BI APIs).

If you are embedding paginated reports for external customers, pay close attention to your workspace roles. Microsoft Learn’s row-level security (RLS) documentation for paginated reports stipulates two non-negotiable rules for app-owns-data embedding:

• You must use a service principal to generate the embed token; master user authentication is not supported for customer-facing paginated reports.
• The service principal must hold at least Member permissions in the target Power BI workspace. If the service principal is only assigned Viewer or Contributor rights, token generation will fail.
• If a report and its underlying semantic model sit in two different workspaces, the service principal must be at least a Member of both workspaces.

2. Row-Level Security (RLS) and SSO Nuances​

Securing data for external portal visitors—such as contractors, partners, or customers represented as Contact records in Microsoft Dataverse—requires passing an EffectiveIdentity in the token request.

• Standard Cloud Models: In Power Pages, makers configure a DAX role in Power BI Desktop (for example, [User Name] = username(), mapping to the adx_externalidentity GUID on the Dataverse Contact table) and toggle Apply roles inside the Power Pages design studio’s Power BI component settings.
• Paginated Reports: Because paginated reports run on the SQL Server Reporting Services engine rather than the Analysis Services engine, RLS is configured in Power BI Report Builder using the built-in UserID field as a filter or query parameter (@UserID), which is then populated via the username field in the token’s identities array.
• SSO Data Sources: If your embedded report connects to Single Sign-On (SSO) enabled data sources, Microsoft Learn warns that you must pass a datasourceIdentities entry containing a valid OAuth 2.0 identityBlob for every SSO data source. Furthermore, in app-owns-data embedding, Azure SQL Database is the only DirectQuery data source type that supports SSO identityBlob tokens.

3. Watch Out for Documentation Lag and Feature Boundaries​

As of this rollout, enterprise teams should be aware of a split in Microsoft’s official documentation. Older Microsoft Learn articles covering the Power Pages powerbi Liquid tag and basic component setup—some last updated in 2023 and 2024—still carry warnings stating that "Paginated Power BI reports aren't supported" and that shared datasets across workspaces aren't supported.

Roadmap ID 576793 specifically introduces Embed Token v2 support when configuring Power BI embedding via the Power Pages design studio. Makers should use the updated design studio v2 token configuration workflow rather than assuming legacy manual Liquid tag snippets automatically inherit v2 multi-resource parameters. Additionally, keep in mind that embedded paginated reports have inherent platform limitations in Power BI: they do not support client-side loaded or rendered JavaScript events, dynamic binding, or self-service edit mode.

Finally, a timeless security reminder from Microsoft’s Power Pages guidance: when adding a Power BI component in the design studio, never confuse Embed for your customers with Publish to web. Putting a Power Pages authentication wall in front of a webpage that uses a Publish to web link does not secure the underlying report—anyone with the raw URL can still view and share your data without authentication. For confidential enterprise data, always pair Embed for your customers with Embed Token v2 and properly scoped Row-Level Security.

Summary: Key Takeaways for IT Admins and Makers​

• Use Service Principals with Member Rights: Paginated reports in customer-facing portals require service principal authentication with at least Member permissions on the Power BI workspace.
• Configure V2 in Design Studio: Makers must actively select Embed Token v2 in the Power Pages design studio to unlock RDL, Data Lake Storage, and multi-artifact scenarios.
• Respect Token Lifetimes and RLS: Embed tokens inherit the remaining lifetime of the calling Microsoft Entra token and must be paired with proper RLS roles (EffectiveIdentity) or xmlaPermissions: ReadOnly for chained semantic models.