Guest users are unable to see workspaces

[b_vanderlaan]

I have created a security group SG_FABRIC_ADMINS, where I have added internal and external users. I have granted the security group admin permissions on the Fabric workspaces in the tenant. The internal users can now perform all actions that admin are allowed to do. However, the external users are not able to see workspaces. 

When I added the external user to the workspace on personal title, they were able to see the workspaces briefly, but they were unable to open the items inside it. A moment later, they could no longer see the workspaces as well. When browsing to the workspace using the URL they received the message 'Sorry, you don't have access to that group'. 

In Fabric's admin portal I have enabled all settings regarding guest users for either the specific security group or for the entire organization. 

What could be the reason that external users are not seeing the workspaces, even though the settings regarding guest users are all enabled?

[jankuc]

And do the users have both PBI and Fabric license activated in M365 admin console? That solved the problem for me multiple times. 

[v-hashadapu]

Hi @b_vanderlaan , Hi , hope you are doing well. may i know if the information provided here solved your issue or if you have raised the support ticket as suggested? If your issue's solved either way, please share the insights here, so others with similar issues may find the solution easily.
Thank you

[v-hashadapu]

Hi @b_vanderlaan , Thank you for reaching out to the Microsoft Community Forum.

@deborshi_nag is correct, the guest user must exist as a B2B account, switch to your tenant and have the guest access tenant settings enabled. Since you confirmed these are already configured, the issue is probably something else.

External Guest type identities do not always resolve workspace permissions reliably when access is granted only through a security group. This can cause the behaviour you are seeing, where the workspace briefly appears and then disappears after permission refresh. Try adding the external user directly to the workspace (not only through the security group) and ask them to sign out, sign back in and switch to your tenant again. If the workspace remains visible, the root cause is group-based permission resolution for the Guest identity. In that case, either keep the direct workspace assignment or (if allowed by policy) convert the external account from Guest to Member in Entra ID so group-based access works consistently.

[b_vanderlaan]

The guest user is also added on personal account in the workspace as an admin. I have converted the external account from Guest to Member in Entra. Both did not solve the issue unfortunately.

Another thing I tried was accessing the tenant using the tenant url (https://app.powerbi.com/home?ctid=<tenant_id>). After refreshing the webpage using CTRL+F5 I was able to see the workspace again, but I could not access anything inside it. I tried opening a Dataflow Gen2, Report and Lakehouse, but it said I do not have permissions to access. In the lakehouse I got the PowerBINotAuthorizedException error. 

[v-hashadapu]

Hi @b_vanderlaan , Thank you for reaching out to the Microsoft Community Forum.

Add the same external user to a newly created test workspace and check whether they can open items there. If the same behaviour occurs, it confirms a tenant-side backend authorization synchronization issue for that external identity. In that case, I suggest you to open a Microsoft Support ticket so the Fabric backend permissions for that user can be re-synced.

[svenchio]

Hi @b_vanderlaan no so long ago, I saw a similiar case and I decided to do an experiment and recretate what you described, but first, I'm assuming in your setup, the "guest" is an account outside of your Fabric tenant and the person you invited, accepted the invitation to complete the hand-shake, in my case, this is my guest account; in my case, the Tenant where I host Fabric is innorway.onmicrosoft.com and I'm inviting my accenture.com account

#1. Created a security group and added two members, one is a member within the same domain and the guest as shown below 

#2. Then I added the security group to one of my workspaces 

#3. This is the settings configuration at Tenant for Guests 

#4. I log with my guest credentials and switch to my innorway.onmicrosoft.com tenant 

#5. And I was able to the workspace from my account at Accenture 

I'm sharing the pictures and my test to confirm, based on your descritption, one very likely posibility is that your guests ARE NOT SWITCHING TO YOUR FABRIC HOSTING TENANT (see step #4)  ... this step is usually ignored and assumed that guest can see workspace in their tenant in the same list of workspaces host on another tenant, this IS NOT HOW IT WORKS  😅 ... you need to switch tenants. 

Well, that's my theory and I'm sharing the steps and images to confirm we are both doing the same, hopefully the issue is the tenant switching, but check and let me know. 

Hope your find this information useful, is so, gives a thumbs-up and if I'm correct mark as a solution... best of lucks,! 

[b_vanderlaan]

Thank you for the suggestion. I actually follow the exact same steps as you described, however, I'm unable to see the workspaces after switching the tenant. 

[svenchio]

@b_vanderlaan  not the first time I see one environment with the exact same options having different from another, but I was thinking about the guest user, I did not share details on my guest user that I think is relevant, in my case, my accenture account (guest) does have Power BI pro license as shown below, can you check what licence does your guest have? With regards to what @deborshi_nag  suggested, in the image in step #3, my configuration for "Users can invite guests ..." althought not highlighted, is set as Enabled. 

Let us know to rule that as a potential cause, looking forward ... cheers. 

[deborshi_nag]

Hello @b_vanderlaan 

Have you enabled this setting? Invite external users to your organization

Distribute Power BI Content to External Guest Users with Microsoft Entra B2B - Microsoft Fabric | Mi...

Are there any sensitivity labels in your workspace that says "Only users in my organisation"?

[b_vanderlaan]

@deborshi_nag , @svenchio  I have checked all the settings on the page Export and sharing tenant settings - Microsoft Fabric | Microsoft Learn . All the settings, except for 'Certification' are enabled for either the entire organization or for the specific security group that the user is in. The guest user has a Pro license, which seems to be valid in our tenant as well. There are no sensitivity labels in the tenant.

[svenchio]

mmmm @b_vanderlaan  , this is just a long shot but I remember something like this happend to me in the past, go to your "external account" and change its user type from Guest to Member 

As I share previousy, from this ... 

In the account, click Edit properties, and change the User Type to Member, it should look like this afterwards ... 

Wait between 5 to 10 minutes for the changes to replicate and try ... can the user see the workspace now? Let me know 🤞😅

[b_vanderlaan]

Thanks! But it did not solve the issue unfortunately --> See my more elaborate response above. 

[deborshi_nag]

we have exhausted all options @b_vanderlaan - best to raise a ticket with Microsoft. 

[svenchio]

That's unfortunate @b_vanderlaan , from my side, I did everything I could and share it with you, I started by reproduce the issue, but as shown and explained it worked for me ; also I gave your some additional possibilities based on my prev. experiences but you confirmed that did not fix the issue, hence,  from this point forward, it would be "guess work" from me, so, one last suggestion would be for you to create an official case to MSFT support team to help solve the issue, seems to be something specific on your environment.  Best of lucks and I would hope you consider a thumbs for the assitance provide, cheers!  

[deborshi_nag]

Hello @b_vanderlaan 

There are a few things that should happen before guest users can fully access your Fabric workspace. 

1. They must exist as a B2B users in Microsoft Entra

2. They must swtich their tenant over to yours before they access the item in your Fabric workspace. 

3. You should have enabled 2 settings ate tenant level

 - Guest users can access Microsoft Fabric

 - Guest users can browse and access Fabric content

Export and sharing tenant settings - Microsoft Fabric | Microsoft Learn

[b_vanderlaan]

Thank you for the suggestion. I can confirm we have these three things configured. I actually follow the exact same steps as svenchio described above, however, I'm unable to see the workspaces after switching the tenant.