Reporting
Advanced 14 min read Reporting

Embedded Analytics

Analytics as a product feature, not a detour

Embedded analytics puts BI inside your product: SSO-scoped views, seamless theming, and APIs that ship analytics as a feature — not a portal users must leave for.

embedded analyticsSSOembed SDKwhite labelproduct analytics
Prerequisites: Report Delivery Channels
Before we start

What you will learn

  • Explain white-label embedded BI patterns
  • Secure embeds with SSO and row scoping
  • Choose embed SDK vs API integration
Introduction

What is this?

Embedded analytics renders BI surfaces inside your own application: charts, dashboards or full analytical modules in an iframe/SDK, styled to match the product, secured by SSO so each user sees only their rows. It turns analytics into a product capability — 'your analytics, inside your workflow' — rather than a link out to another tool.

Motivation

Why do you need it?

  • Users decide in the tool they already live in; leaving breaks flow.
  • White-label embeds make the product look complete.
  • SSO + row-level scoping keeps multi-tenant embedding safe.
  • APIs/SDKs (not CSS hacks) make embedding maintainable.
Think about it

Mental model

Imagine

A built-in navigation system vs a paper atlas

Think of

Embedded vs portal analytics

The atlas (portal) lives in the glovebox — helpful but you leave driving to consult it. The built-in nav (embed) is part of the dashboard already, themed like the car, using your route. Product users get the nav; nobody stops driving to look at an atlas.

Mechanics

How it works

  • Embed SDK/iframe renders reports in-app with the product's theme.
  • SSO (OIDC/JWT) authorizes the viewer; row scoping comes from identity claims.
  • Multi-tenancy: identical layout, per-tenant data via server-side session.
  • White-labeling: platform chrome hidden; product owns the chrome.
  • APIs serve analytics data directly when a dedicated UI isn't needed.

Secure embed request flow.

User
SSO token
BI platform
Row scope
In-app render
Hands-on

Examples

White-label embed contract

White-label embed contract
App side:
  GET /bi/token -> SSO JWT {sub: u_123, tenant: acme}
  <iframe src="https://bi.app/embed/dash/rev
                 ?token=<jwt>&theme=light" />
 
BI side:
  verifies JWT, maps sub+tenant to row scope
  renders the revenue dashboard, white-labeled
  (no BI chrome; app owns nav/theme)
 
Audit: row scope logged per embed request.

The app, BI platform and security contract cooperate: user identity, tenant scope and themed render — minimal moving parts.

Real world

In production

  • A SaaS CRM embeds per-customer usage analytics behind its nav — every customer sees their rows.
  • An ops tool embeds live queue boards in-app instead of a separate BI window.
  • A partner portal white-labels analytics so resellers read their own volume numbers.
Guidelines

Best practices

  • Embed via the platform SDK/iframe + SSO — never a hardcoded key.
  • Carry tenant/customer in the token so every embed row-scopes automatically.
  • Theme embeds to the product; hide the BI chrome where white-labeling matters.
  • Audit embed usage and rotate tokens; watch embed latency p95.
Watch out

Common mistakes

  • Embedding with a shared API key — every tenant reads everyone's data.
  • Left-of-path styling the SDK fights, instead of theming once.
  • Forgetting row scope: white-label looks right, shows wrong numbers.
  • Embedding heavy full-portal dashboards that lag the product.
When things break

Debugging tips

  • Embed shows wrong tenant → check the token claims and row-scope mapping.
  • Embed blank → token expiry/SAN mismatch; validate SSO exchange first.
  • White-label leaking BI chrome → correct theming/layout settings at embed time.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

Multi-tenant embed security is anchored on:

2

White-labeling means the BI platform chrome is replaced by the product's own.

Go deeper

Official documentation

Power BI - embed for your customers
docs