Cross tenant dataset sharing - exception

[gotters]

We are trying to share a dataset with a client that has a different pbi tenant.

We have added the users as guests in our AD and added them to a security group on the dataset workspace with Viewer role (no access given to the reports themselves in a separate workspace)

In addition we gave build permissions on the datasets to the same security group.

They then login with PBI desktop, specifying our organisation via the myorgname.onmicrosoft.com entry which allows them to now see the datasets, ie when they click GetData they are able to view and list the datasets that we have shared with them.

However if they click "Connect" to either of those datasets they get the following obscure any message.

Any help would be appreciated.

[gotters]

We got it to work by changing them to contributor role on the dataset workspace, but that's too high of a permission set. Why doesn't it work with Viewer role and Build permissions on the semantic model? ie why does that setup throw an exception?

[v-jialongy-msft]

Hi @gotters 

In Power BI, the Viewer role combined with Build permissions on the semantic model can cause issues because these roles and permissions are designed for different purposes. The Viewer role is primarily for consuming reports and dashboards, while Build permissions allow users to create new content based on the semantic model.

When these permissions are combined, it can lead to conflicts or exceptions because the Viewer role does not inherently support the creation or modification of content, which is what Build permissions enable. This mismatch can cause the system to throw an exception as it tries to reconcile the conflicting permissions.

If you need users to have both viewing and building capabilities, consider assigning them a role that inherently supports both, such as the Contributor role.


Semantic model permissions - Power BI | Microsoft Learn
Roles in workspaces in Power BI - Power BI | Microsoft Learn

Best Regards,

Jayleny

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[gotters]

Thanks but it doesnt add up...

All we're trying to do is give an external tenant access to the semantic model via PBI desktop so that they can create new reports based on that model data. We don't want to give them access to start modifying that model in any way - and contributor access will give them that.

It seems obvious that there should be a viewer only role/permission set that allows this kind of setup?

[v-jialongy-msft]

Hi @gotters 

You mentioned in your reply that you want them to be able to create reports based on the model. The viewer role only has permission to view reports, while the contributor role can create reports based on the model.

Best Regards,

Jayleny

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[gotters]

So then what edit permissions are relevant in a dataset-only workspace? the chart you provided says Edit in the workspace content - surely that applies to the models also? I dont see any other permission that defines edits on the semantic-model?

Are you 100% sure?

[gotters]

I have confirmed that Contributor allows a user to go ahead and modify the dataset it self, not just the reports. Which means we are stuck... Viewer does not allow external access to view the datasets and Contributor provides too much access.

Surely this cant be the case??

[wanajo38]

Hello,

You can share reports with external users and they can log in with their principal account. You need to modify the tenant setting and 1 more setting in your data model.

Tenant setting: "Guest users can work with shared semantic models in their tenants." needs to be enabled.

Semantic model: "External sharing" needs to be allowed.

Then they can use your semantic model on Power BI desktop (they will find your model in "external data")