Forum Discussion
Power BI Service cross Workspace not working for external users
Hi Kalyan228, good point.
If the semantic model has a sensitivity label set to Confidential, this may prevent external users from accessing the data, depending on the Microsoft 365 compliance policies configured for your organisation.If the semantic model is labelled as “Confidential” and the associated policy disallows external access, then:- Even with read and build permissions, external users will not be able to view the data.
- Power BI will block access in accordance with the organisation’s data protection policies.
Recommended Actions
- Review the Sensitivity Label Policy
Ask your Power BI or Microsoft 365 compliance administrator to check the policy configuration in Microsoft Purview or the Compliance Centre:- Confirm whether the “Confidential” label allows external access.
- Review any restrictions on sharing or viewing content outside the organisation.
- Test with a Different Label
Temporarily remove the label or change it to “Internal” and test whether external users can access the data.
If this resolves the issue, it confirms that the label policy is the root cause. - Request Policy Adjustment
If the “Confidential” label must remain in use, request that the policy be adjusted to allow external access for specific security groups or scenarios.
Official References:
Learn about sensitivity labels | Microsoft Learn
✅ If this answer resolved your issue, please mark it as correct to assist other members of the community.
Note: The following content has been formatted using AI assistance for clarity and readability.
Cross-workspace semantic model sharing limitations: External users may not be able to access semantic models shared across workspaces unless specific configurations are enabled. This is especially true if the model resides in a workspace they don’t have access to.
- RLS and external user propagation: Even if the RLS script is correct and the external user security group (SG) has read access, the model may not properly propagate RLS filters across workspaces for external users.
- Semantic model sharing preview: Microsoft currently supports external semantic model sharing as a preview feature. If this isn’t enabled or configured correctly, external users may see blank data.
- Workspace permissions mismatch: External users might have access to the report but not to the underlying dataset in Workspace B, causing the data to appear blank.
SOLUTIONS:
- Enable semantic model sharing preview
Go to Power BI Admin Portal and ensure the “Allow external guest users to access semantic models” setting is enabled. - Verify workspace permissions
Confirm that external users have at least Viewer access to Workspace B where the dataset resides. - Use in-place semantic model sharing
Instead of relying on cross-workspace links, publish the dataset directly into the same workspace as the report or use in-place sharing to ensure access continuity. - Test with simplified RLS.
- Use same workspace for report and model
As you’ve already tested, publishing the dataset to the same workspace as the report resolves the issue. This suggests that cross-workspace sharing is the blocker.
Super User🔍 Possible Causes
- Insufficient Permissions on Workspace B
Even if users have read access to the dataset, they may also require explicit access to the workspace or the shared dataset.
Please verify that the external SG is directly included in the dataset permissions. - Missing “Build” Permission on the Shared Dataset
When sharing a dataset that uses RLS, it is essential to enable the “Allow users to build new content” option.
Without this permission, RLS may prevent data from being displayed. - Mismatch Between RLS and External Users
In some cases, RLS may not behave as expected for external users if their User Principal Name (UPN) is not recognised correctly.
You can test this using the USERPRINCIPALNAME() function to confirm that the returned value matches the expected format. - Known Limitations of RLS Across Workspaces
There are known limitations when applying RLS to datasets shared across workspaces, particularly with external users.
Publishing to “My Workspace” works because it avoids cross-workspace sharing.
🛠️ Recommended Solutions
- Review Dataset Sharing in Workspace B
Navigate to Workspace B → Dataset → “Manage Permissions”.
Ensure the external SG has:- Read access
- Build permission (required for RLS to function properly)
- Enable “Allow Build” When Sharing the Dataset
When sharing the dataset, ensure the following option is selected:- “Allow recipients to build content with the data”
- Test RLS Using USERPRINCIPALNAME()
Create a temporary measure:
LoggedInUser = USERPRINCIPALNAME()
Approach: Recreate the Model in Workspace A
This avoids cross-workspace sharing and simplifies RLS behaviour.
📚 Official References
- https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-row-level-security
- https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-share-datasets
✅ If this answer resolved your issue, please mark it as correct to assist other members of the community.
Hi Zanqueta ,
Thanks for the quick reply !
UserPrincipalname() return the correct id of the external user I have tested this.
Yes , for Workspace B semantic model is configred with the Correct Security Group of External users with only read access, as mentioned above granting them build access as well resolves the issue ?
Pls confirm
Thanks 🙂