Power Bi Service Principal. Authenticate using service principal and a certificate. Create an azure active directory security group and add the app.

Using service principal profiles enables the isv app to host multiple customers on a single power bi tenant. The service principal generates the embed token, and the embed token specifies the effective identity of the user, which can be an arbitrary string that you use.