Access external shared report/workspace as guest user - error 401

[naanii]

Hello,

For a couple of months now, we are experiencing issues when sharing PBI Reports/Fabric workspaces to guest users.

I have a Microsoft tenant with multiple accounts and domains. I work for a customer where I want to edit PBI reports and content of Workspaces like notebooks.

Account 1 (domain x) is able to view and edit multiple workspaces and PBI reports.

Account 2 (domain y) is not able to view any of the shared resources. Most of the time, the error message which I added below is returned to me when navigating to the URL of the workspace or report.

The tenants are two-way trusted.

I have created four different support cases (for PBI, AZure AD etc..). None of the product-specialists were able to find out why account 2 is not able to view or edit resources. That's why they asked me to create new cases.

Today we've seen a new information-prompt in Microsoft Fabric Admin Portal -> Tenant Settings -> Export and Sharing settings -> Allow Azure Active Directory guest users to access Microsoft Fabric:

'Azure Active Directory B2B guest users are restricted from accessing Microsoft Fabric even if they have permissions.'

We have enabled this setting (since the beginning) for the entire organisation and it still works for domain 1.

Does anyone knows what can cause this issue? I personally think it's related to Azure AD because we have assigned the Guest users different permissions (inluding Admin) to the report. The same permissions works for internal users.

[Anonymous]

Hi @naanii 

I suppose that there is a conflict between Microsoft Fabric and B2B user access features.

I recommend you create a support ticket to contact Power BI support team to confirm if this is the situation and get further support.

The official channel of Microsoft Fabric Support:

Microsoft Fabric Support and Status | Microsoft Fabric

Link about how to create a support ticket:

How to create a Fabric and Power BI Support ticket - Power BI | Microsoft Learn

Best Regards,

Zhengdong Xu

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[naanii]

Hi Zhengdong,

I have spoken to several people from support, but none of them were able to help me out.

They are just asking me to create new support tickets after they were not able to help me out. It also takes really long to connect with people from support, that's why I am asking the community for trying to help me fixing this issue.

After all: I appreciate your help.

[Anonymous]

Hi @naanii 

An error status of 401 indicates that the request is missing valid authentication credentials for the target resource.

In the Power BI service, users outside your organization can successfully view shared data if you don't set up row-level security.

However, if you set RLS on the semantic model, you must add the users accessing the user to the role, otherwise they won't be able to see anything. Please check your RLS settings and try again.

You can check out the following link, which may help you:
Azure Active Directory B2B Access - Microsoft Fabric Community

You can check if only this one out-of-domain guest account can't view any shared resources.

In the Microsoft Entra ID, you can set an external user as a User Type Member. In Power BI, support for UserType Members is currently in preview. Please note the following:

External members can't currently use their Power BI licenses in their home tenant to access content and perform activities in the provider tenant. Instead, the appropriate licenses must be explicitly granted in the provider tenant. External members are similar to internal users on a provider tenant.

Microsoft Purview Information Protection isn't supported by external members. Admins in the provider tenant are not advised to enable information protection for external members.

In some cases, external members may see an error when they first try to sign in to the provider tenant. To unblock these external members, give them access to Power BI items, such as workspaces, semantic models, or reports, and then have them sign back in.

This link may help you:

Distribute Power BI content to external guest users using Microsoft Entra B2B - Power BI | Microsoft...

Best Regards,

Zhengdong Xu

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[naanii]

Hi,

Thanks for your response.

We have setup two different accounts (which are in separate tenants) as guest-users the same way.

One account is not able to view the report and is configured/invited the same was as the other account.

We have tried different configs, also the ones you've mentoined. Unfortunately, none of them helped us out.

[GilbertQ]

Hi @naanii 

I have found it to be numerous errors and issues when working with guest accounts and power bi and fabric what? I do with customers is always request and internal domain account to use the. Typically of a lot of issues and challenges when using guest accounts which consumes a lot of time and resources.

[naanii]

Hi Gilbert,

It is really strange that the issues are domain-based, right?

The functionality to invite guest users to our Fabric-environment is working, but there must be something in the domain-settings which blocks some domains to authenticaticate into external tenants.

[GilbertQ]

Hi @naanii 

Yeah i would also confirm that the guest account is created and validated in Entra ID (Azure Active Directory)