Forum Discussion

rinokejima's avatar
rinokejima
Frequent Visitor
2 months ago

Direct workspace URL access fails for external guest users invited as Contributors in Fabric

Microsoft Fabricにて外部ゲストユーザーを共同作成者として招待した際に、ワークスペースURLを直接開いても弾かれてしまう 下記手順を実行した結果、最終的に添付写真のようなエラーが出てしまいました。 考えられる原因がございましたら、ご教示いただけますと幸いです。 - 自社Azule Entra IDにて該当の外部ゲストユーザーを追加・本人承諾を実施 - 各種ワークスペース設定を...
Need Help
v-shchada-msft's avatar
v-shchada-msft
Community Support
2 months ago

Hi rinokejima,
Thank you for reaching out to the Microsoft Fabric Community Forum.

Thanks for the update. Since the tenant settings have already been reviewed, I don't think we can conclude yet that the guest user needs a Power BI Pro or Fabric license in your tenant. I'd first verify that the user exists in Microsoft Entra ID as a Guest account and that the invitation status is Accepted.

Since the user is unable to access the tenant, it may be helpful to confirm the guest account configuration and invitation status in Microsoft Entra ID. As a quick test, you could also invite another external user and check whether the same behavior occurs. If the second guest experiences the same issue, that would help determine whether the problem is related to the environment configuration or specific to the current guest account.

Please refer to the Microsoft documentation:

https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-admin-entra-b2b
https://learn.microsoft.com/en-us/entra/external-id/user-properties

Thanks and Regards.

  • rinokejima's avatar
    rinokejima
    Frequent Visitor
    2 months ago

    Hi v-shchada-msft ,

    Thank you for your support. Just to confirm, the dummy account we are using uses a completely different domain and fully aligns with our company compliance rules.

    Since the account is already 'Accepted' and the domain setup is clean, we believe the block is happening at the Fabric authorization layer.

    (Sorry for in Japanese)

     

    • Parchitect's avatar
      Parchitect
      Solution Sage
      2 months ago
      v-shchada-msft rinokejima

       

      Thanks for confirming that the guest account exists in Microsoft Entra ID and that the invitation status is Accepted.

       

      At this point I would not jump directly to licensing yet.

       

      If the guest user could access your Fabric tenant but could not open or contribute to the workspace, then licensing would be the next thing to check.

       

      But in this case, the key issue seems to be that the guest user cannot access the tenant/Fabric context at all. That points more toward a B2B / cross-tenant access / Conditional Access issue.

       

      I would check two things next:

       

      1. Ask the guest user for the exact error message
      Please ask the guest user to share the exact error message or screenshot they see when trying to access the tenant/workspace.

       

      If the error contains an AADSTS code, correlation ID, request ID, tenant ID, or Conditional Access message, that usually points directly to the blocking reason.

       

      2. Check Microsoft Entra sign-in logs
      Ask the Entra/Fabric admin to check:
      Microsoft Entra admin center
      → Monitoring
      → Sign-in logs
      → Filter on the guest user
      → Open the failed sign-in attempt

       

      The most useful fields are:
      - Status / failure reason
      - Error code
      - Conditional Access result
      - Resource / application
      - Device compliance / MFA requirement
      - Cross-tenant access details

       

      Also check both sides of the B2B configuration:
      Resource tenant, your organization:
      - External collaboration settings
      - Cross-tenant access settings: inbound B2B collaboration
      - Conditional Access policies applied to guest users
      - Whether the external tenant/domain
      • rinokejima's avatar
        rinokejima
        Frequent Visitor
        2 months ago

        Hi Parchitect , v-shchada-msft ,

        Thank you for your continued support.
        Attached is the error message, which translates to: "Sorry, you don't have access to this group. You have been redirected to your personal workspace."