PowerBI - RLS for External Users

Hello Mcaraff !

Thank you for posting on Fabric community !

 You can’t add truly external emails directly to a semantic model role. The error means the users aren’t in your tenant. You need to let them in via Microsoft Entra B2B (guest accounts) or use the newer cross-tenant sharing, then assign them to your RLS role.

Turn on external (B2B) sharing in the Power BI Admin portal (Distribute Power BI content to external guest users) and, if needed, the toggle that lets guest users edit/manage content. 

https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-admin-entra-b2b

 https://powerbi.microsoft.com/en-us/blog/azure-ad-b2b-guest-users-can-now-edit-and-manage-content-in-power-bi-to-collaborate-better-across-organizations/

Invite them (or add them to an Entra security group). Now they’re inside your org as guests and can be referenced in security then roles.https://learn.microsoft.com/en-us/entra/external-id/what-is-b2b

Add the Entra security group (recommended) to your RLS role, in the semantic model under security and add the group, not individual emails. RLS applies only to viewer role members; it won’t restrict admin/member/contributor. https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security

Then sare the report or the app with those guests. Don't forget that they need Pro/PPU unless the workspace is on Premium/Fabric capacity. (https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-share-dashboards)

You can share the semantic model/app so externals stay in their home tenant (no need for guest creation). RLS still works, but use USEROBJECTID() and make sure external sharing is enabled. This is still a preview feature https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-dataset-external-org-share-provider