Forum Discussion
Post ProdigyMicrosoft Entra B2B Consent - What data is actually collected when external users access a Power BI
Microsoft Entra B2B Consent - What data is actually collected when external users access a Power BI report?
Hi everyone,
We have the following setup:
Power BI tenant: Our Company
External user: abc.com
The Power BI report is hosted in our tenant and shared with an external user using Microsoft Entra B2B.
When the external user accesses the report, Microsoft displays the consent screen stating that the our organization can:
Receive your profile data
Collect and log your activity
Use your profile data and activity data
Our security team would like to understand exactly what these permissions mean.
Specifically:
What profile data is shared with the resource tenant?
What activity is actually collected and logged?
Is it only authentication and Power BI usage within our tenant?
Or can the resource tenant see activity from the user's home tenant (abc)?
Does accepting this consent allow the resource tenant to access Outlook, Teams, OneDrive, SharePoint, or other Microsoft 365 data?
Are these permissions simply the standard Microsoft Entra B2B consent required for cross-tenant Power BI access, or do they grant any additional access?
Is there any Microsoft documentation that clearly lists exactly what is collected under "Collect and log your activity"?
Our goal is to provide an accurate security assessment to our customer before enabling external Power BI sharing.
Thank you!
Hi manoj_0911,
The consent screen you're seeing is the standard Microsoft Entra B2B collaboration consent that appears when a guest user accesses resources in another tenant. It does not give the resource tenant access to the user's Outlook, Teams, OneDrive, SharePoint, or other Microsoft 365 data from their home tenant.
For your specific questions:
- Profile data typically includes basic directory information required for collaboration, such as display name, email/UPN, object ID, and other guest account attributes maintained in the resource tenant.
- Collect and log your activity refers to activity within the resource tenant, such as authentication events, sign-ins, report access, sharing actions, and audit records generated while using Power BI and other resources hosted in that tenant.
- The resource tenant can see activity related to the guest user's interaction with their tenant's resources, not the user's activity in the home tenant.
- Accepting this consent does not grant blanket access to the guest user's mailbox, Teams chats, OneDrive files, or SharePoint content. Additional permissions and separate application consent would be required for those scenarios.
For Power BI external sharing, this is generally the standard Entra B2B consent flow required to establish the guest identity and allow auditing, governance, and access control in the host tenant.
One document worth reviewing is the Microsoft Learn guidance on Power BI external sharing with Microsoft Entra B2B and the Entra B2B collaboration/auditing documentation, which explains guest identities, audit logs, and the visibility the resource tenant has over guest activity.
5 Replies
- ShahRukhSameer
Solution Sage
Hi manoj_0911,
The consent screen you're seeing is the standard Microsoft Entra B2B collaboration consent that appears when a guest user accesses resources in another tenant. It does not give the resource tenant access to the user's Outlook, Teams, OneDrive, SharePoint, or other Microsoft 365 data from their home tenant.
For your specific questions:
- Profile data typically includes basic directory information required for collaboration, such as display name, email/UPN, object ID, and other guest account attributes maintained in the resource tenant.
- Collect and log your activity refers to activity within the resource tenant, such as authentication events, sign-ins, report access, sharing actions, and audit records generated while using Power BI and other resources hosted in that tenant.
- The resource tenant can see activity related to the guest user's interaction with their tenant's resources, not the user's activity in the home tenant.
- Accepting this consent does not grant blanket access to the guest user's mailbox, Teams chats, OneDrive files, or SharePoint content. Additional permissions and separate application consent would be required for those scenarios.
For Power BI external sharing, this is generally the standard Entra B2B consent flow required to establish the guest identity and allow auditing, governance, and access control in the host tenant.
One document worth reviewing is the Microsoft Learn guidance on Power BI external sharing with Microsoft Entra B2B and the Entra B2B collaboration/auditing documentation, which explains guest identities, audit logs, and the visibility the resource tenant has over guest activity.
Murtaza_GhafoorSuper User
Hi manoj_0911,
Whenexternal user sign in to access PBI report hosted in your environment. they are actually authenicating against Microsoft Entra ID in your environment.
This persmission typically meansReceive your profile data – Allows your organization to identify the user details (for example name, email address, and user ID).
Collect and log your activity – Allows your organization to record sign-in activity and application usage information for auditing, security, and compliance purposes in future incase there is some mishap.
Use your profile data and activity data – Allows Microsoft 365 and Power BI services to personalize and authorize access based on the user's identity.
You may be able to remove this settings but it depends on your tennnent setup settings.
Is this a security concern, generally no, these are standards for Micorsoft Entra B2B setup.
If this helps, ✓ Mark as Kudos | Help Others
v-abhinavmuCommunity Support
Hi manoj_0911,
Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to Murtaza_Ghafoor for sharing valuable insights.
Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.
Thank you for being part of the Microsoft Fabric Community.
- manoj_0911
No proper answer yet
Hi ShahRukhSameer Murtaza_Ghafoor: the same Issue is there when we are giving access rights to external customer(abc.com i.e. another company), to download document from folder( my company).
Just to check is there any way we can suppress the Warning coming to external customer or any standard document from MS so to share with them for confirmation that there is no data/security breach of abc.com company? Please suggest. Thank you.
