Power BI Multitenant Architecture and Licensing Guide
Question details
Design a secure multitenant Power BI architecture for embedding isolated reports and self-service analytics for customers.

- Product
- Microsoft Power BI
- Device & OS
- not provided
- Scenario
- Designing an environment where customers can access isolated datasets, dashboards, and reports using Power BI Embedded and Microsoft Fabric.
- Observed behavior
- Customers require isolated access to embedded analytics, necessitating a secure application-owns-data architecture and proper capacity licensing without requiring individual user licenses.
Before designing your architecture, clearly map out your customer data isolation requirements and evaluate your budget for Power BI Embedded or Microsoft Fabric capacities.
Implement an Application-Owns-Data Architecture
Use Power BI Embedded with an application-owns-data model to securely host and isolate analytics for multitenant customers.
The application-owns-data model is the standard approach for multitenant customer embedding. It allows your application to authenticate with Power BI using a master account or service principal, shielding end-users from the underlying Power BI authentication process.
Create separate workspaces, datasets, and data connections for each customer tenant to ensure strict data and resource isolation.
If you choose to use shared datasets instead of separate workspaces, enforce isolation by configuring dynamic Row-Level Security (RLS) to restrict data access based on the tenant identity passed from your application.
Purchase the required Power BI Embedded (A SKUs) or Microsoft Fabric (F SKUs) capacity. Assign your multitenant workspaces to this capacity to enable embedding.

Manage Licenses for Developers and Consumers
Determine the correct licensing structure for your internal development team versus your external customer base.
Switch to WPS Office for Everyday Business Reporting
While Power BI handles complex multitenant analytics, your business still needs a reliable, cost-effective suite for daily reports, documentation, and presentations. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office.

Frequently Asked Questions
Do my external customers need Power BI Pro licenses to view embedded reports?
No. If you utilize the application-owns-data architecture and back your workspaces with a Power BI Embedded or Microsoft Fabric capacity, your external customers can view embedded reports without needing individual Power BI Pro licenses.
How do I ensure data isolation between different customers in a multitenant environment?
You can achieve data isolation by creating separate workspaces and datasets for each tenant. Alternatively, you can use a single shared dataset and implement dynamic Row-Level Security (RLS) to filter data based on the tenant identifier passed by your application.
Can I use Microsoft Fabric for multitenant customer embedding?
Yes, Microsoft Fabric capacities (F SKUs) support embedded analytics and provide unified data engineering and warehousing. However, you must evaluate its specific capacity limits, features, and licensing rules separately from legacy Power BI Embedded.
Where can I get specialized support for Power BI multitenant architecture?
Because architecture and licensing rules are highly specific to Microsoft's ecosystem, it is highly recommended to post detailed environment questions in the Microsoft Power BI Community or consult a dedicated Microsoft licensing specialist.




