Forum Discussion
Power BI Service cross Workspace not working for external users
Hi Kalyan228, good point.
If the semantic model has a sensitivity label set to Confidential, this may prevent external users from accessing the data, depending on the Microsoft 365 compliance policies configured for your organisation.If the semantic model is labelled as “Confidential” and the associated policy disallows external access, then:- Even with read and build permissions, external users will not be able to view the data.
- Power BI will block access in accordance with the organisation’s data protection policies.
Recommended Actions
- Review the Sensitivity Label Policy
Ask your Power BI or Microsoft 365 compliance administrator to check the policy configuration in Microsoft Purview or the Compliance Centre:- Confirm whether the “Confidential” label allows external access.
- Review any restrictions on sharing or viewing content outside the organisation.
- Test with a Different Label
Temporarily remove the label or change it to “Internal” and test whether external users can access the data.
If this resolves the issue, it confirms that the label policy is the root cause. - Request Policy Adjustment
If the “Confidential” label must remain in use, request that the policy be adjusted to allow external access for specific security groups or scenarios.
Official References:
Learn about sensitivity labels | Microsoft Learn
✅ If this answer resolved your issue, please mark it as correct to assist other members of the community.
Note: The following content has been formatted using AI assistance for clarity and readability.
Cross-workspace semantic model sharing limitations: External users may not be able to access semantic models shared across workspaces unless specific configurations are enabled. This is especially true if the model resides in a workspace they don’t have access to.
- RLS and external user propagation: Even if the RLS script is correct and the external user security group (SG) has read access, the model may not properly propagate RLS filters across workspaces for external users.
- Semantic model sharing preview: Microsoft currently supports external semantic model sharing as a preview feature. If this isn’t enabled or configured correctly, external users may see blank data.
- Workspace permissions mismatch: External users might have access to the report but not to the underlying dataset in Workspace B, causing the data to appear blank.
SOLUTIONS:
- Enable semantic model sharing preview
Go to Power BI Admin Portal and ensure the “Allow external guest users to access semantic models” setting is enabled. - Verify workspace permissions
Confirm that external users have at least Viewer access to Workspace B where the dataset resides. - Use in-place semantic model sharing
Instead of relying on cross-workspace links, publish the dataset directly into the same workspace as the report or use in-place sharing to ensure access continuity. - Test with simplified RLS.
- Use same workspace for report and model
As you’ve already tested, publishing the dataset to the same workspace as the report resolves the issue. This suggests that cross-workspace sharing is the blocker.
Super UserYes Kalyan228 , granting Build permission to the external users' security group on the semantic model in Workspace B is required for Row-Level Security (RLS) to function correctly in cross-workspace scenarios.
When a semantic model is shared across workspaces, Power BI requires that users have permission to build content using that dataset — even if they are not actively creating new reports. This permission enables the service to apply RLS rules and return filtered data appropriately.
In my opinion, could you try it with a single user before applying it to the whole group.
Please, let me know if it worked.
Here you have the Official References:
Hello Zanqueta & v-kpoloju-msft ,
Sorry, I had missed ur comments I have checked everything but nothing is working, although I see on the shared semantic model sensitivity is applied as Confidential does this is causing the issue ? what exactly does this sensitivity function in general when selected as Internal or confidential ?- Zanqueta
Hi Kalyan228, good point.
If the semantic model has a sensitivity label set to Confidential, this may prevent external users from accessing the data, depending on the Microsoft 365 compliance policies configured for your organisation.If the semantic model is labelled as “Confidential” and the associated policy disallows external access, then:- Even with read and build permissions, external users will not be able to view the data.
- Power BI will block access in accordance with the organisation’s data protection policies.
Recommended Actions
- Review the Sensitivity Label Policy
Ask your Power BI or Microsoft 365 compliance administrator to check the policy configuration in Microsoft Purview or the Compliance Centre:- Confirm whether the “Confidential” label allows external access.
- Review any restrictions on sharing or viewing content outside the organisation.
- Test with a Different Label
Temporarily remove the label or change it to “Internal” and test whether external users can access the data.
If this resolves the issue, it confirms that the label policy is the root cause. - Request Policy Adjustment
If the “Confidential” label must remain in use, request that the policy be adjusted to allow external access for specific security groups or scenarios.
Official References:
Learn about sensitivity labels | Microsoft Learn
✅ If this answer resolved your issue, please mark it as correct to assist other members of the community.
Zanqueta As mentioned in the topic description, report uses multiple shared datasets, I have checked all of them now, in all the Workspaces External SG have given only Read access, but how come in the report for those externals are seeing the data and why only for this workspace data is not fetching to the externals confused.
