Hi,
we are building a web application that will be used by different tenants, our customers, and will allow them to gain some insights about their business processes. You can consider this web application to be a "visualization tool" to display meaningful charts and diagrams starting from raw data collected by our flagship product.
I am responsible for maintaining and improving the platform, whose initial development was outsourced to another company.
First of all, the application leverages Power BI to embed dashboards in the web page; each tenant will have its own workspace (group) containing a set of dashboards. It is worth noting that we are in charge of maintaining the different workspaces and the tenants have no Power BI license, they will access their data only through our platform. The application code currently implements the "user owns data" scenario, and obtains token to access Power BI by authenticating with our Power BI Pro account data; the dashboards are then embedded in the browser by including the access token as "AAD" type (not "Embed") in JS.
I thought about changing the authentication process by switching to the "app owns data" scenario, since we have just one license and we do not use tenant identity to authenticate to Power BI, not to mention that the password of the user associated to the license expires periodically and this can lead to unnoticed service disruption. So far so good, I set up a service principal and changed the token type to Embed in the JS part, everything works just fine.
Yesterday I stumbled upon the infamous embed token limit, which means that right now we have reached a usage of 10% of free embed tokens. The docs recommend to switch to dedicated capacity, so our choices seem to be either Embedded or Premium.
Consider that right now our cost related to Power BI is $10 each month for the Pro license, and that using the Embedded SKU with the basic tier A1 will increase that cost by ~70x. We would like to avoid incurring in such high charges, since we cannot easily justify hundreds of dollars each month to our future few customers, just for a data visualization platform.
Given that the current authentication and embedding scenario seems to work, with the caveat that the web application is still not available to any of our customers and we are only performing internal tests on it, is it feasible to continue using the password approach with the AAD access token for embedding or is there any drawback that might come up in the future when the system will be running in production for our tenants?
For example, there can be some limitation or throttling to the Azure Active Directory/Power BI API or embed URL when using the Pro license, whereas Embedded or Premium have no limitation? How can we expect the application to behave when multiple accesses/requests will be issued from different browsers that refer to the same licensee? I cannot find such information on the docs.
I understand the security concern of disclosing the AAD token, since it will be available by inspecting browser network calls, but we can rest on the fact that this is meant to be a controlled platform and a limited number of users/tenants will be granted access.
Thanks in advance for any clarification on this topic.