PowerBI - RLS for External Users

[mcaraff]

Hi Community!

I created a RLS for a PBI, but some people are outside of the organization.

When I go on the Semantic model > Security > and I add people to the User group, I get the error "some people are outside of the organization".

Is there a way to fix this?

Thank you!

[Anonymous]

Hi @mcaraff,

Thanks for reaching out to the Microsoft fabric community forum. The error you’re seeing means those users are not part of your organization’s tenant, so Power BI won’t let you add them directly into a semantic model role. As 

@AmiraBedh has responded to your query, kindly go through the response and check if it answers your query.

I would also take a moment to thank @AmiraBedh, for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference.

If I misunderstand your needs or you still have problems on it, please feel free to let us know.  

Best Regards,
Hammad.

[AmiraBedh · Accepted solution]

Hello Mcaraff !

Thank you for posting on Fabric community !

 You can’t add truly external emails directly to a semantic model role. The error means the users aren’t in your tenant. You need to let them in via Microsoft Entra B2B (guest accounts) or use the newer cross-tenant sharing, then assign them to your RLS role.

Turn on external (B2B) sharing in the Power BI Admin portal (Distribute Power BI content to external guest users) and, if needed, the toggle that lets guest users edit/manage content. 

https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-admin-entra-b2b

 https://powerbi.microsoft.com/en-us/blog/azure-ad-b2b-guest-users-can-now-edit-and-manage-content-...

Invite them (or add them to an Entra security group). Now they’re inside your org as guests and can be referenced in security then roles.https://learn.microsoft.com/en-us/entra/external-id/what-is-b2b

Add the Entra security group (recommended) to your RLS role, in the semantic model under security and add the group, not individual emails. RLS applies only to viewer role members; it won’t restrict admin/member/contributor. https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security

Then sare the report or the app with those guests. Don't forget that they need Pro/PPU unless the workspace is on Premium/Fabric capacity. (https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-share-dashboards)

You can share the semantic model/app so externals stay in their home tenant (no need for guest creation). RLS still works, but use USEROBJECTID() and make sure external sharing is enabled. This is still a preview feature https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-dataset-external-org-share-prov...