Power BI Migration – Accessing SharePoint, Databricks from other Tenant via B2B

[YashikaAgrawal]

Hi,

We are working on a Power BI migration from the INFY tenant to the TATA tenant.

In our current setup:
SharePoint Online, Databricks is hosted in the INFY tenant.
Some users have been migrated to the TATA tenant.

After migration, these users will have Azure AD B2B guest/member access to the INFY tenant.
Eg. current email TOM@TATA.com, after migration/cutoff his email will be same TOM@TATA.com

Question:
a. Will migrated TATA users (with B2B guest access) be able to access SharePoint in the INFY tenant and use it as a data source for Power BI reports hosted in INFY?
b. Will migrated TATA users (with B2B guest access) be able to access Databricks in the INFY tenant and use it as a data source for Power BI reports hosted in INFY?

Any considerations around permissions, licensing, or limitations would be helpful.

Thanks,

[GilbertQ]

Hi @YashikaAgrawal 

As far as I'm aware, when you go to a new tenant, even though they will have the same email address as the underlying Guids, which is the actual identifier, will all be changed. So you would have to remap this access in both of your scenarios.

[YashikaAgrawal]

Thanks for your reply. When you say "you would have to remap this access", could you please clarify exactly what needs to be remapped?

Do you mean:

• Reassigning SharePoint permissions for the migrated TATA users in the INFY tenant?
• Reassigning Databricks workspace permissions in the INFY tenant?
• Updating Power BI dataset credentials/connections?

Just want to confirm if the remapping is required for both the data source level (SharePoint/Databricks) and the report-level permissions in Power BI, or only at one layer.

Thanks,

[V-yubandi-msft]

Thank you for your question. When users move from the INFY tenant to the TATA tenant and then receive B2B guest access back into INFY, their Azure AD identity changes, even if their email remains the same. This means any permissions linked to their original identity won’t transfer automatically.

You will need to

1. Reassign SharePoint permissions in INFY for the new guest accounts

2. Reassign Databricks workspace, cluster, and table permissions in INFY

3. Update Power BI dataset credentials if they connect to SharePoint or Databricks

4. Reassign Power BI workspace/report/RLS roles for the new guest accounts

Best regards, 

Yugandhar.

[YashikaAgrawal]

Thank you for the reply.

For the point 1

“When you say reassign SharePoint permissions, do you mean adding the new guest accounts at the site/library level in SharePoint Online via ‘Share site’ or the SharePoint Admin Center?
Where do we need do that.

For point 2 (“Reassign Databricks workspace, cluster, and table permissions in HAVI”), could you please clarify:
Does this mean we need to manually re-add the new guest accounts in the Databricks Admin Console (workspace settings) everywhere the old member accounts had access?
Do we also need to reassign permissions at cluster, SQL warehouse, table, and DBFS folder level individually?

For point 3 regarding updating dataset credentials — since we use OAuth for Databricks, do you mean we should re-authenticate the dataset connection in the Power BI Service (under dataset settings → data source credentials) after migration, so it uses the new guest account’s token?

For point 4
Go to the Power BI workspace → Manage Permissions → Add the new guest account (email) to the same role(s) they had before migration., is this correcT?

Thanks

[V-yubandi-msft · Accepted solution]

Thanks for taking the time.
1. Yes, you'll need to reassign permissions for the new guest accounts in the INFY tenant. Although the email remains the same, the underlying identity changes, so SharePoint won’t recognize them automatically. Go to the SharePoint site, then Settings-Site Permissions - Share site, and enter the guest user’s email. Make sure the guest user has already been invited to the INFY tenant before granting access.

2. You also need to manually re add the guest users in the INFY hosted Databricks workspace. This involves adding them in the Admin Console under Users and reassigning access to clusters, SQL warehouses, tables, and DBFS folders.

3. Since you’re using OAuth for Databricks, you’ll need to re authenticate the dataset connection in Power BI Service. Go to the workspace, then Dataset Settings- Data Source Credentials, and re authenticate using the guest account’s token.

4. Your understanding is correct here as well. Add the guest user to the same roles as before, and if you’re using Row Level Security, ensure they’re assigned to the correct roles in the dataset security settings.

Hope this helps.

[YashikaAgrawal]

Thank you for the reply.

Existing System : Both Infy, TATA users and Power BI workspace are in tenant i.,e INFY.
ONLY users are getting migrated to TATA tenant, power BI workspace remains in INFY tenant.

1 doubt, about the licensing part.
Eg. current email TOM@TATA.com, after migration/cutoff his email will be same TOM@TATA.com

Currently he has E5 license in INFY tenant.

Will TOM needs a new license in TATA tenant to access the reports in INFy tenant?

Please reply.

Thanks,