Embedding Migration: Tableau Embedded to Power BI Embedded¶

A comprehensive guide for migrating embedded analytics from Tableau Embedded Analytics to Power BI Embedded, covering pricing, SDK, architecture, multi-tenancy, and white-labeling.

Overview¶

Embedded analytics — the ability to embed interactive reports inside customer-facing applications, partner portals, and internal tools — is where the cost difference between Tableau and Power BI is most dramatic. Tableau uses per-user pricing for embedded scenarios. Power BI Embedded uses capacity-based pricing that serves unlimited users within a fixed compute budget. This guide covers the full migration path.

1. Architecture comparison¶

1.1 High-level architecture¶

flowchart LR
    subgraph Tableau["Tableau Embedded"]
        TAB_SRV[Tableau Server/Cloud<br/>Per-user licensing] --> TAB_API[JavaScript API v3<br/>Embed via iframe]
        TAB_API --> TAB_APP[Web Application<br/>Tableau session per user]
    end

    subgraph PowerBI["Power BI Embedded"]
        PBI_SVC[Power BI Service<br/>Fabric capacity] --> PBI_API[Power BI JS SDK<br/>Embed via iframe]
        PBI_API --> PBI_APP[Web Application<br/>Embed token per session]
        PBI_SVC --> PBI_TOKEN[Token Service<br/>Service principal auth]
    end

1.2 Key architectural differences¶

2. Pricing comparison¶

2.1 Tableau Embedded pricing¶

Tableau Embedded Analytics requires Viewer licenses for every external user who views embedded content:

Infrastructure costs (Tableau Server VMs to handle embedded traffic) add 20-40% to these numbers.

2.2 Power BI Embedded pricing¶

Power BI Embedded uses Fabric capacity SKUs. You pay for compute, not users:

Concurrent users depend on report complexity, data volume, and query patterns. Start with F32 or F64, monitor with Capacity Metrics App, and scale as needed. Auto-scale is available for burst scenarios.

2.3 Cost comparison at scale¶

3. Embedding approaches¶

3.1 Tableau JavaScript API to Power BI JavaScript SDK¶

3.2 Tableau embed code example¶

<!-- Tableau Embedded -->
<div id="tableauViz"></div>
<script>
    var containerDiv = document.getElementById("tableauViz");
    var url = "https://tableau-server/views/Dashboard/Sheet1";
    var options = {
        hideTabs: true,
        hideToolbar: true,
        width: "100%",
        height: "600px",
        onFirstInteractive: function () {
            console.log("Dashboard loaded");
        },
    };
    var viz = new tableau.Viz(containerDiv, url, options);
</script>

3.3 Power BI embed code equivalent¶

<!-- Power BI Embedded -->
<div id="reportContainer"></div>
<script src="https://cdn.jsdelivr.net/npm/powerbi-client/dist/powerbi.min.js"></script>
<script>
    var models = window["powerbi-client"].models;
    var embedConfig = {
        type: "report",
        id: "report-id-guid",
        embedUrl: "https://app.powerbi.com/reportEmbed?reportId=...",
        accessToken: "embed-token-from-backend",
        tokenType: models.TokenType.Embed,
        settings: {
            navContentPaneEnabled: false,
            filterPaneEnabled: false,
            layoutType: models.LayoutType.Custom,
            customLayout: {
                displayOption: models.DisplayOption.FitToWidth,
            },
        },
    };
    var reportContainer = document.getElementById("reportContainer");
    var report = powerbi.embed(reportContainer, embedConfig);

    report.on("loaded", function () {
        console.log("Report loaded");
    });

    report.on("dataSelected", function (event) {
        console.log("Data selected:", event.detail);
    });
</script>

3.4 SDK feature comparison¶

4. Authentication and security¶

4.1 Authentication model comparison¶

4.2 App-owns-data pattern (most common for embedding)¶

// Token generation flow (backend):
// 1. App authenticates to Entra ID using service principal
// 2. App calls Power BI REST API to generate embed token
// 3. Embed token is passed to the frontend
// 4. Frontend uses embed token to render the report
// 5. RLS identity is included in the token to filter data

// Backend (Node.js example):
const { ConfidentialClientApplication } = require("@azure/msal-node");
const axios = require("axios");

// Step 1: Get AAD token
const msalConfig = {
    auth: {
        clientId: "service-principal-client-id",
        clientSecret: "client-secret",
        authority: "https://login.microsoftonline.com/tenant-id"
    }
};
const cca = new ConfidentialClientApplication(msalConfig);
const tokenResponse = await cca.acquireTokenByClientCredential({
    scopes: ["https://analysis.windows.net/powerbi/api/.default"]
});

// Step 2: Generate embed token with RLS
const embedTokenRequest = {
    datasets: [{ id: "dataset-id" }],
    reports: [{ id: "report-id" }],
    identities: [{
        username: "user@company.com",
        roles: ["RegionFilter"],
        datasets: ["dataset-id"]
    }]
};

const embedToken = await axios.post(
    "https://api.powerbi.com/v1.0/myorg/GenerateToken",
    embedTokenRequest,
    { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } }
);

5. Multi-tenancy patterns¶

5.1 Comparison of isolation approaches¶

5.2 RLS-based multi-tenancy (recommended)¶

// Single semantic model serves all tenants
// RLS role: TenantFilter
// Table: Sales
// DAX expression:
[TenantID] = USERNAME()
// or
LOOKUPVALUE(
    TenantMapping[TenantID],
    TenantMapping[UserEmail], USERPRINCIPALNAME()
) = Sales[TenantID]

// Embed token includes effective identity:
{
    "identities": [{
        "username": "tenant-123",
        "roles": ["TenantFilter"],
        "datasets": ["dataset-id"]
    }]
}

5.3 Workspace-based multi-tenancy¶

For stronger isolation, create a workspace per tenant with a dedicated semantic model:

Workspace: "Embedded - Tenant A"
  - Tenant A Semantic Model (filtered to Tenant A data)
  - Tenant A Report

Workspace: "Embedded - Tenant B"
  - Tenant B Semantic Model (filtered to Tenant B data)
  - Tenant B Report

This provides complete data isolation but increases management overhead.

6. White-labeling and branding¶

6.1 Tableau branding limitations¶

Tableau offers limited branding for embedded scenarios:

• Custom logo on Tableau Server login page
• CSS overrides (limited, can break on upgrades)
• Hide toolbar and tabs
• Custom URL (via reverse proxy)

6.2 Power BI branding capabilities¶

Power BI Embedded provides comprehensive branding control:

6.3 Theme JSON for branding¶

{
    "name": "Customer Portal Theme",
    "dataColors": ["#0063B1", "#2D7D9A", "#77B900", "#FF8C00", "#E81123"],
    "background": "#F5F5F5",
    "foreground": "#333333",
    "tableAccent": "#0063B1",
    "good": "#77B900",
    "neutral": "#FFB900",
    "bad": "#E81123",
    "visualStyles": {
        "*": {
            "*": {
                "title": [
                    {
                        "fontFamily": "Your Brand Font",
                        "fontSize": 14,
                        "color": { "solid": { "color": "#0063B1" } }
                    }
                ]
            }
        }
    }
}

7. Performance optimization¶

7.1 Embedded performance best practices¶

7.2 Capacity sizing for embedded¶

8. Migration steps¶

8.1 Migration execution plan¶

1. Inventory embedded Tableau content — list all embedded dashboards, their applications, and user counts
2. Set up Power BI Embedded capacity — provision an F-SKU in Azure portal
3. Register a service principal — create an Entra ID app registration for the embedding application
4. Migrate reports — convert Tableau workbooks to Power BI reports (see Tutorial: Workbook to PBIX)
5. Publish to embedding workspace — publish reports to a dedicated workspace
6. Implement token generation — build backend service to generate embed tokens
7. Update frontend — replace Tableau JS API with Power BI JS SDK
8. Configure RLS — implement row-level security for multi-tenancy
9. Apply branding — create and apply Power BI theme
10. Performance test — load test with expected concurrent users; right-size capacity
11. Cut over — switch the application from Tableau to Power BI
12. Decommission — remove Tableau Viewer licenses

8.2 Testing checklist¶

• Reports render correctly in the embedding container
• RLS filters data correctly for each tenant/user
• Filters applied programmatically work as expected
• Events (loaded, rendered, dataSelected) fire correctly
• Export (PDF, data) works from embedded context
• Mobile/responsive layout renders correctly
• Performance under load meets SLA (< 3 second render time)
• Token refresh works (tokens expire after 60 minutes by default)
• White-labeling matches brand guidelines
• Error handling displays custom error messages

Last updated: 2026-04-30 Maintainers: CSA-in-a-Box core team Related: TCO Analysis | Server Migration | Migration Playbook