"Anonymous Guest" user appearing to be viewing notebook

[spencer_sa]

One of my colleagues was developing a notebook when they noticed an 'Anonymous Guest' user appearing to view their notebook.

We are using Entra ID security groups with specific users, so I'd have expected to see a real user appearing here.
Before I raise a support ticket (we have sensitive data), does anyone have any pointers as to what might be happening here?

[v-lgarikapat · Accepted solution]

Hi @spencer_sa ,
Just checking in to see if you had a chance to raise the support ticket we talked about earlier. Let me know if you’ve already done it or if you need any help with the process.

Happy to assist if needed!
https://learn.microsoft.com/en-us/power-bi/support/create-support-ticket

If this post helped resolve your issue, please consider giving it Kudos and marking it as the Accepted Solution. This not only acknowledges the support provided but also helps other community members find relevant solutions more easily.

We appreciate your engagement and thank you for being an active part of the community.

Best regards,
LakshmiNarayana

[spencer_sa · Accepted solution]

Follow up post-support call and with a great deal of thanks to the product team.
Firstly, all of the access was set up correctly.  We control access via EntraID security groups and there were only 12 people who could have accessed it - no sharing or links.
Support confirmed that only 2 people (me and the other user) had accessed the notebook.

Another piece of anecdotal evidence was that the other user logged out for the day and exactly at this point the Anonymous Guest appeared.

The cause is down to when a user has ran a job and the left the session, the tooltip that shows who is in a notebook with you no longer 'knows' who the user is when querying Graph API.  So it displays 'Anonymous Guest' where maybe 'Can't get user details' might be more accurate - and it has to display something.

[Note:  I've Accepted the Solution so the support ticket response is visible as part of the issue in case others see it.]

[v-lgarikapat]

Hi @spencer_sa ,

If your question has been answered, kindly mark the appropriate response as the Accepted Solution. This small step goes a long way in helping others with similar issues.

We appreciate your collaboration and support!

Best regards,
LakshmiNarayana

[v-lgarikapat]

Hi @spencer_sa ,

If your issue has been resolved, please mark the most helpful reply as the Accepted Solution to close the thread. This helps ensure the discussion remains useful for other community members.

Thank you for your attention, and we look forward to your confirmation.

Best regards,
LakshmiNarayana

[v-lgarikapat]

Hi @spencer_sa ,

 If your issue has been resolved, please consider marking the most helpful reply as the accepted solution. This helps other community members who may encounter the same issue to find answers more efficiently.

If you're still facing challenges, feel free to let us know—we’ll be glad to assist you further.

Looking forward to your response.

Best regards,
LakshmiNarayana.

[spencer_sa]

It's not resolved.  None of the items are what's happening save for the glitch and as it's not a concrete point I can safely use, I'll raise a support ticket for it.
I was checking on here first in case anyone had seen it themselves.

[v-lgarikapat · Accepted solution]

Hi @spencer_sa ,
Just checking in to see if you had a chance to raise the support ticket we talked about earlier. Let me know if you’ve already done it or if you need any help with the process.

Happy to assist if needed!
https://learn.microsoft.com/en-us/power-bi/support/create-support-ticket

If this post helped resolve your issue, please consider giving it Kudos and marking it as the Accepted Solution. This not only acknowledges the support provided but also helps other community members find relevant solutions more easily.

We appreciate your engagement and thank you for being an active part of the community.

Best regards,
LakshmiNarayana

[spencer_sa]

The support ticket has been raised and being worked upon by MS engineers.
We've already confirmed that the access permissions have no guests and are not permissive, and that there is no sharing/linking going on.
We were fortunate in that the issue manifested whilst in a Teams call with the engineer, so it was immediately evident.

[v-lgarikapat]

Hi @spencer_sa,

Thanks for reaching out to the Microsoft fabric community forum.

The “Anonymous Guest” user appearing in your notebook session likely indicates that someone is accessing the notebook without proper authentication, possibly via a shared link or incomplete identity federation. Given that you're using Microsoft Entra ID (formerly Azure AD) for access control, this should not normally happen if everything is correctly configured.

Possible Reasons:

1. Notebook Shared Publicly (or via Anonymous Link)
   If the notebook (or the workspace it's in) was shared via a link that doesn't enforce authentication, anyone with that link can access it — and they will appear as “Anonymous Guest.”
2. Session Glitch or Temporary Auth Issue
   Sometimes, users with expired sessions or authentication tokens may temporarily appear as "Anonymous Guest" if the system hasn't re-authenticated them properly.
3. External Users with Incomplete Federation
   If an external user (not in your Entra tenant) was invited but hasn’t fully accepted or federated their identity, they might show up this way.
4. Bug or Misconfiguration in Access Policies
   There could be a misconfiguration in access settings (e.g., public workspace setting, broken Entra integration), especially if using custom roles or groups.

How to Investigate and Fix:

1. Check Access Control Settings

• Go to your Azure portal > Entra ID > Enterprise Applications.
• Review access settings for the application (likely Synapse, Fabric, or similar).
• Make sure only named users or groups are assigned access.

2. Check Notebook Sharing Settings

• Go to the workspace and check the sharing or access permissions for the specific notebook.
• Ensure no "Anyone with the link" or anonymous access options are enabled.

3.Audit Logs

• Use Microsoft Purview or Azure Monitor to:

• Review sign-ins and access logs.
• Search for any “Anonymous Guest” sign-in events.

• See who accessed what, when, and from which IP address.

4. Force Authentication

• Ensure that access to your notebooks requires Microsoft Entra sign-in.
• Disable any “preview” or legacy access mechanisms that might bypass SSO.

5.Enforce Conditional Access

• Set conditional access policies to block unknown or unmanaged devices or require MFA for all sessions.

Recommended Action:

• Revoke shared access links, if any exist.
• Immediately disable guest or anonymous access from the Azure portal (or Fabric/Synapse settings).
  
  Official Microsoft Docs for Reference:
  Manage guest access with access reviews - Microsoft Entra ID Governance | Microsoft Learn
  Restrict guest user access permissions - Microsoft Entra ID | Microsoft Learn
  Microsoft Entra B2B best practices and recommendations - Microsoft Entra External ID | Microsoft Lea...
  Microsoft Entra ID Governance deployment guide to govern guest and partner access - Microsoft Entra ...

If you found this post helpful, please 'consider giving it Kudos' and marking it as the 'accepted solution' to assist other members in finding it more easily.

Thank you.