Need guidance on safely testing Copilot in embedded Power BI reports via iframe

Mikalai Liashkevich 0 Reputation points
2026-07-02T14:39:24.23+00:00

Hello Microsoft Support,

We are looking into enabling Copilot for Power BI reports embedded in our web application via iframe, but we want to make sure we test it safely before enabling anything in production.

Our embedded reports are customer-facing and use Row-Level Security to keep each customer’s data separate. Some reports may also contain business data and PII.

Our intended approach is to use a dedicated demo workspace, create two demo customer accounts, configure RLS so each account can only access its own customer data, and then test Copilot inside the embedded iframe report. We want to confirm that Copilot only uses data available to the signed-in user and cannot return data from another customer’s scope.

We would like to understand:

  1. What settings are required to enable Copilot inside embedded Power BI reports via iframe?
  2. Can Copilot be enabled only for the demo workspace, selected reports, and selected demo users?
  3. If we enable the required tenant/capacity data processing setting, could Copilot become available to other embedded reports or users outside the demo workspace?
  4. Does Copilot fully respect RLS and Azure AD identity when the report is accessed through an embedded iframe?
  5. Is this demo workspace + two demo accounts + RLS test a valid approach to verify customer data isolation?
  6. Are there any additional security checks or limitations we should consider before moving to production?

Could you please confirm whether this is the right approach and advise how we should proceed safely?
What is the best approach for such task?

Thank you!

Microsoft Copilot | Microsoft 365 Copilot | Development
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-07-02T14:39:50.5933333+00:00
    1. Settings required to enable Copilot in embedded Power BI reports via iframe

    For secure web or portal embedding (Power BI Service "Embed report Website or portal" scenario):

    1. The tenant must have Copilot enabled by the Fabric/Power BI admin.
    2. The workspace that hosts the report must be in Power BI Premium or paid Fabric capacity.
    3. In the Power BI Service, for each report to be embedded:
      • Open the report.
      • From the File menu, select Embed report Website or portal.
      • In the embed dialog, select the Enable Copilot checkbox.

    Once this is done, Copilot is available inside the embedded iframe for that report.

    1. Scope: enabling Copilot only for demo workspace / selected reports / selected users

    From the provided information:

    • Copilot can be enabled per embedded report via the Enable Copilot checkbox in the embed dialog.
    • Copilot availability is also controlled at the tenant level by administrators via the admin portal.
    • Copilot requires Power BI Premium or Fabric capacity in the workspace.

    This allows:

    • Scoping to a demo workspace by placing only test reports in a Premium/Fabric-backed demo workspace and enabling Copilot there.
    • Scoping to selected reports by enabling Copilot only in the embed dialog for those specific reports.

    User-level scoping is handled through normal access control (workspace/report permissions, RLS, and tenant-level Copilot enablement). The context does not describe a Copilot setting that targets individual users per report, beyond standard security groups and access control used for governance.

    1. Impact of tenant/capacity data processing settings on other workspaces/reports

    The context states:

    • Tenant administrators can enable or disable Copilot through the admin portal.
    • Copilot requires an active Copilot tenant switch and Premium/Fabric capacity in the workspace.

    Enabling the tenant-level Copilot switch and capacity data processing settings makes Copilot available where prerequisites are met, but Copilot appears in embedded reports only when:

    • The workspace is on Premium/Fabric capacity, and
    • The Enable Copilot checkbox is selected in the embed dialog for that report.

    Therefore, turning on tenant and capacity settings does not automatically enable Copilot for all embedded reports; it enables the capability, which then must be explicitly turned on per report via the embed dialog.

    1. RLS, identity, and Copilot in embedded iframe

    Relevant points from the context:

    • In embedded scenarios, Power BI enforces all policies (such as access or RLS) based on the identity or embed token used.
    • For "embed for your customers" (App owns data), ISV policy decisions are encrypted in an embed token. Power BI Client APIs automatically append this token as an Authorization: EmbedToken header, and Power BI enforces all policies (access, RLS, OLS) exactly as specified when the token was generated.
    • When using RLS with embed tokens, the effective identity supplied with the token determines which data is visible.

    Copilot in Power BI operates on the data available in the semantic model and report for the current user/session. Because Power BI enforces RLS and object-level security based on the identity or embed token, Copilot only has access to the data that the embedded report exposes for that user. It does not bypass RLS or Azure AD identity; it works within the same security boundaries.

    1. Validity of the demo workspace + two demo accounts + RLS test

    The proposed test setup aligns with recommended practices:

    • Use a dedicated demo workspace on Premium/Fabric capacity.
    • Configure Row-Level Security so each demo account (or effective identity in embed tokens) can only see its own customer data.
    • Embed the report via iframe with Copilot enabled in the embed dialog.
    • Verify that prompts to Copilot only return data within the users RLS scope.

    This is a valid and appropriate approach to verify that customer data isolation is preserved when Copilot is enabled in embedded reports.

    1. Additional security checks and limitations before production

    Key considerations from the context:

    • Governance and phased rollout
      • Use security groups and grant access to Copilot only after users are trained on its limitations and use cases.
      • Roll out Copilot in phases, starting with test/demo workspaces before production.
    • Semantic model preparation
      • Ensure proper naming conventions, field descriptions, and good modeling practices.
      • Set up linguistic modeling and follow Copilot preparation guidance so outputs are accurate and grounded.
    • Business user preparation
      • Explain when to use Copilot versus directly using report visuals.
      • Overuse of Copilot can increase capacity usage and reduce efficiency.
    • Output evaluation and responsible use
      • Copilot outputs can be inaccurate or low quality and are nondeterministic.
      • Establish internal guidance for validating Copilot responses against trusted data.
    • Privacy and security model
      • Copilot does not store prompts or responses after the session ends.
      • Data stays within the organizations tenant boundary and is not used to train foundation models.
      • Tenant admins can centrally enable or disable Copilot.
    • Embedded security features
      • For App-owns-data embedding, RLS and OLS are enforced via the embed tokens effective identity.
      • Assigning users to roles in the Power BI service does not affect RLS/OLS when using embed tokens; ensure the effective identity in tokens is correctly configured.

    Before moving to production, recommended checks include:

    1. Confirm tenant-level Copilot settings and capacity assignments are correct and limited to the intended workspaces.
    2. Validate RLS and any object-level security thoroughly with multiple test identities/effective identities.
    3. Review semantic models for PII exposure and ensure RLS/OLS rules prevent cross-customer access.
    4. Document internal guidance for responsible use and validation of Copilot outputs.

    This combination of demo workspace testing, RLS validation, and governance/semantic model preparation is an appropriate and safe approach for introducing Copilot into customer-facing embedded Power BI reports.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.