Guest users can't set Lakehouses as data destination in Dataflow Gen2

[mebg159]

Hello experts,

Guest users (outside the organization) are allowed to create activities in Fabric, but when they create queries in Dataflow Gen2 and try to set the data destination as one of the existing Lakehouses in the workspace, the connection redirects to their original tenant. Why is this happening? The guest users must connect into the Lakehouses. 

Thanks

[v-achippa]

Hi @mebg159,

Thank you for reaching out to Microsoft Fabric Community.

• Most of the organizations restrict guest users from writing or storing data in their fabric resources to prevent data exfiltration risks. This is enforced by Microsoft Entra ID policies.
• Ensure that the guest users are assigned appropriate roles and permissions within the Fabric workspace and ensure they have write permissions to the Lakehouse. Fabric Admin or Workspace Admin can assign roles and permissions to external users within the Fabric workspace.
• Ensure that the cross-tenant access settings are enabled.

If this post helps, then please consider Accepting as the solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! 

Thanks and regards,

Anjan Kumar Chippa

[mebg159]

Where exactly is the setting to enable cross-tenant access? I've just checked in the tenant admin settings and can't find it.

Also, isnt it easier if all external users just access to the current tenant lakehouses? Why arr they redirecting me by default?

thanks!

[v-achippa]

Hi @mebg159,

• Cross-tenant access settings are not directly managed in the Fabric Tenant Admin settings. Instead, these settings are configured in Microsoft Entra ID
  https://entra.microsoft.com/#home

• Go to Microsoft Entra Admin Center, from the left-hand menu, select External Identities > Cross-tenant access settings. Under Default settings, ensure that B2B collaboration is enabled and allows external users to interact with your tenant's resources.

• If you want external users to seamlessly interact with Lakehouses in your tenant without being redirected, they must explicitly switch to your tenant when working in fabric. Since these users are outside of organization, it is important to ensure security by granting only the necessary permissions, enabling multi-factor authentication, and monitoring their activities to minimize data security and compliance risks.

If this post helps, then please consider Accepting as the solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! 

Thanks and regards,

Anjan Kumar Chippa

[mebg159]

• Hello! Sorry for the late response. All external users are switched into the guest tenant, so that is why is so odd that they get redirected to their default tenant when trying to set a lakehouse as a destination in the dataflow gen2.

for this settings i need to talk to the tenant and see if this is a solution, but for now, we have managed a workaround: we have created a custom email with the tenants domain, and use this when setting the lakehouse as destination. I was just hoping a more practical solution from Microsoft. If a users is signed in into a external tenant, he should be able to see all lakehouses from that tenant and not from the default tenant

[v-achippa · Accepted solution]

Hi @mebg159,

This behavior is likely due to Microsoft Entra ID authentication and cross-tenant session policies.

I suggest using an incognito/private browser session to ensure the user remains signed into the correct tenant.

If the issue still persists, i recommend escalating it to microsoft support, so please raise a support ticket.

How to create a Fabric and Power BI Support ticket - Power BI | Microsoft Learn

If this post helps, then please consider Accepting as the solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! 

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @mebg159,

As we haven’t heard back from you, we are closing this thread for now. If you have any further issue, please raise a new thread in the community forum, we are ready to assist you on it.

Thank you for being part of Microsoft Fabric Community.

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @mebg159,

We wanted to kindly follow up to check if the solution I have provided for the issue worked.
If my response addressed, please mark it as Accept as solution and click Yes if you found it helpful.

Regards,

Anjan Kumar Chippa

[v-achippa]

Hi @mebg159,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided for the issue worked.
If my response addressed, please mark it as Accept as solution and click Yes if you found it helpful.

Regards,

Anjan Kumar Chippa

[v-achippa]

Hi @mebg159,

Thank you for reaching out to Microsoft Fabric Community.

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided for the issue worked? or let us know if you need any further assistance?
If my response addressed, please mark it as Accept as solution and click Yes if you found it helpful.

Regards,

Anjan Kumar Chippa

[govindarajan_d]

Hi @mebg159,

In one of our clients we faced a similar problem. External users were not able to actually connect to Lakehouse at all in DF g2. It seems to be either a limitation/bug. 

You can raise a Microsoft Support Ticket for this.