We are using Power BI Premium and RLS to share reporting data with clients. To do this we set up a guest user in our AAD tenant, have an invite generated, and apply the appropriate security group. The guest then accepts the conditions of the invite and if they are in a Microsoft AD environment (self or 365) they then can access the report seeing only their data without having to set up any additional login information. The RLS is based on the individual's email address with which we set up the AAD guest user and matches the underlying dataset.
We have an individual in a self-hosted MS Windows AD environment. Each morning they log in using the username DOMAIN/tblack. Their email is tgreen@red.com which was changed from tblack@red.com last year, the computer username remained the same. In our AD we have tgreen@red.com as the email address and that is the address associated with the underlying data. When the individual replies to the invite sent to tgreen@red.com, they do not have to set up a password (the process that is required if using a public email), they are allowed into the tenant and can access Power BI but the data is "blank" (this is the expected Power BI behavior if there is not an RLS match or there is no data).
What I suspect is happing is behind the scenes some process is passing the username or some value from their self-hosted AD to Power BI that does not match the RLS. The current work around is that I set up a gmail account for the client and this works, but as this is pushed out to more clients it is becoming a larger issue. Does anyone have a suggestion as to how I might set up the credentials to avoid this problem?
