Forum Discussion
Power BI Service cross Workspace not working for external users
We have a Report which is in Workspace A, the report si created using various shared semanticmodels from different othere workspaces out of those for only data wrorkspace B for all the externals users data is showing total blank, RLS script is correct, external user SG is added with Read access but somehow the externals users are not seeing the data, I have tested by downloading Pbix file from Workspace B and published that into My Workspace and connected that to the report instead of the connection from Workspace B then it is working of external users i.e. Cross workspace then it is not working for externals users. we have many sources from different shared semantic models workspaces out of those but only for a Source we are seeing this issue, what may be reasons and how to resolve this.
External Users End screen
Hi Kalyan228, good point.
If the semantic model has a sensitivity label set to Confidential, this may prevent external users from accessing the data, depending on the Microsoft 365 compliance policies configured for your organisation.If the semantic model is labelled as “Confidential” and the associated policy disallows external access, then:- Even with read and build permissions, external users will not be able to view the data.
- Power BI will block access in accordance with the organisation’s data protection policies.
Recommended Actions
- Review the Sensitivity Label Policy
Ask your Power BI or Microsoft 365 compliance administrator to check the policy configuration in Microsoft Purview or the Compliance Centre:- Confirm whether the “Confidential” label allows external access.
- Review any restrictions on sharing or viewing content outside the organisation.
- Test with a Different Label
Temporarily remove the label or change it to “Internal” and test whether external users can access the data.
If this resolves the issue, it confirms that the label policy is the root cause. - Request Policy Adjustment
If the “Confidential” label must remain in use, request that the policy be adjusted to allow external access for specific security groups or scenarios.
Official References:
Learn about sensitivity labels | Microsoft Learn
✅ If this answer resolved your issue, please mark it as correct to assist other members of the community.
Note: The following content has been formatted using AI assistance for clarity and readability.
Cross-workspace semantic model sharing limitations: External users may not be able to access semantic models shared across workspaces unless specific configurations are enabled. This is especially true if the model resides in a workspace they don’t have access to.
- RLS and external user propagation: Even if the RLS script is correct and the external user security group (SG) has read access, the model may not properly propagate RLS filters across workspaces for external users.
- Semantic model sharing preview: Microsoft currently supports external semantic model sharing as a preview feature. If this isn’t enabled or configured correctly, external users may see blank data.
- Workspace permissions mismatch: External users might have access to the report but not to the underlying dataset in Workspace B, causing the data to appear blank.
SOLUTIONS:
- Enable semantic model sharing preview
Go to Power BI Admin Portal and ensure the “Allow external guest users to access semantic models” setting is enabled. - Verify workspace permissions
Confirm that external users have at least Viewer access to Workspace B where the dataset resides. - Use in-place semantic model sharing
Instead of relying on cross-workspace links, publish the dataset directly into the same workspace as the report or use in-place sharing to ensure access continuity. - Test with simplified RLS.
- Use same workspace for report and model
As you’ve already tested, publishing the dataset to the same workspace as the report resolves the issue. This suggests that cross-workspace sharing is the blocker.
11 Replies
- Zanqueta
Super User
🔍 Possible Causes
- Insufficient Permissions on Workspace B
Even if users have read access to the dataset, they may also require explicit access to the workspace or the shared dataset.
Please verify that the external SG is directly included in the dataset permissions. - Missing “Build” Permission on the Shared Dataset
When sharing a dataset that uses RLS, it is essential to enable the “Allow users to build new content” option.
Without this permission, RLS may prevent data from being displayed. - Mismatch Between RLS and External Users
In some cases, RLS may not behave as expected for external users if their User Principal Name (UPN) is not recognised correctly.
You can test this using the USERPRINCIPALNAME() function to confirm that the returned value matches the expected format. - Known Limitations of RLS Across Workspaces
There are known limitations when applying RLS to datasets shared across workspaces, particularly with external users.
Publishing to “My Workspace” works because it avoids cross-workspace sharing.
🛠️ Recommended Solutions
- Review Dataset Sharing in Workspace B
Navigate to Workspace B → Dataset → “Manage Permissions”.
Ensure the external SG has:- Read access
- Build permission (required for RLS to function properly)
- Enable “Allow Build” When Sharing the Dataset
When sharing the dataset, ensure the following option is selected:- “Allow recipients to build content with the data”
- Test RLS Using USERPRINCIPALNAME()
Create a temporary measure:
LoggedInUser = USERPRINCIPALNAME()
Use this to confirm that the value returned matches what your RLS logic expects for external users.Alternative
Approach: Recreate the Model in Workspace AIf feasible, consider copying the semantic model from Workspace B into Workspace A.
This avoids cross-workspace sharing and simplifies RLS behaviour.📚 Official References
- https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-row-level-security
- https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-share-datasets
✅ If this answer resolved your issue, please mark it as correct to assist other members of the community.
Hi Zanqueta ,
Thanks for the quick reply !
UserPrincipalname() return the correct id of the external user I have tested this.
Yes , for Workspace B semantic model is configred with the Correct Security Group of External users with only read access, as mentioned above granting them build access as well resolves the issue ?
Pls confirm
Thanks 🙂
v-kpoloju-msftCommunity Support
Hi Kalyan228,
Thank you for reaching out to the Microsoft Fabric Community Forum. Also, thanks to Zanqueta, for his inputs on this thread.
Based on your explanation, this behaviour usually happens when external (guest) users access a report that connects to a shared semantic model (dataset) located in another workspace. Although RLS and permissions appear correct, external users may see blank visuals if the dataset’s cross-workspace or cross-tenant sharing settings aren’t fully enabled.
Tenant settings: In the source tenant (Workspace B), ensure Power BI admin has enabled “Allow external guest users to access Power BI content” and “Allow external users to use shared semantic models”. https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-admin-entra-b2b
Dataset permissions: In Workspace B, open the dataset → Settings > Permissions → confirm the external user or their security group has at least Viewer (and ideally Build) permission. Dataset external sharing: Turn on “Allow external users to discover and use this dataset” in dataset settings. https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-dataset-external-org-share-about
RLS validation – Check if the RLS filter uses USERPRINCIPALNAME(); external guest UPNs often appear as user#EXT@domain. Adjust RLS mapping if needed. License/capacity: Confirm the workspace is on Premium capacity or the guest user has a Pro/PPU license. After updating these, ask the external user to re-sign in (or use an incognito browser) and test again. https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-share-dashboards
Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.
Thank you for using the Microsoft Fabric Community Forum.
- v-kpoloju-msft
Hi Kalyan228,
Just checking in to see if the issue has been resolved on your end. If the earlier suggestions helped, that’s great to hear! And if you’re still facing challenges, feel free to share more details happy to assist further.Thank you.
- Zanqueta
Yes Kalyan228 , granting Build permission to the external users' security group on the semantic model in Workspace B is required for Row-Level Security (RLS) to function correctly in cross-workspace scenarios.
When a semantic model is shared across workspaces, Power BI requires that users have permission to build content using that dataset — even if they are not actively creating new reports. This permission enables the service to apply RLS rules and return filtered data appropriately.
In my opinion, could you try it with a single user before applying it to the whole group.
Please, let me know if it worked.Here you have the Official References:
Hello Zanqueta & v-kpoloju-msft ,
Sorry, I had missed ur comments I have checked everything but nothing is working, although I see on the shared semantic model sensitivity is applied as Confidential does this is causing the issue ? what exactly does this sensitivity function in general when selected as Internal or confidential ?- Zanqueta
Hi Kalyan228, good point.
If the semantic model has a sensitivity label set to Confidential, this may prevent external users from accessing the data, depending on the Microsoft 365 compliance policies configured for your organisation.If the semantic model is labelled as “Confidential” and the associated policy disallows external access, then:- Even with read and build permissions, external users will not be able to view the data.
- Power BI will block access in accordance with the organisation’s data protection policies.
Recommended Actions
- Review the Sensitivity Label Policy
Ask your Power BI or Microsoft 365 compliance administrator to check the policy configuration in Microsoft Purview or the Compliance Centre:- Confirm whether the “Confidential” label allows external access.
- Review any restrictions on sharing or viewing content outside the organisation.
- Test with a Different Label
Temporarily remove the label or change it to “Internal” and test whether external users can access the data.
If this resolves the issue, it confirms that the label policy is the root cause. - Request Policy Adjustment
If the “Confidential” label must remain in use, request that the policy be adjusted to allow external access for specific security groups or scenarios.
Official References:
Learn about sensitivity labels | Microsoft Learn
✅ If this answer resolved your issue, please mark it as correct to assist other members of the community.
Zanqueta As mentioned in the topic description, report uses multiple shared datasets, I have checked all of them now, in all the Workspaces External SG have given only Read access, but how come in the report for those externals are seeing the data and why only for this workspace data is not fetching to the externals confused.
- anilgavhane
Note: The following content has been formatted using AI assistance for clarity and readability.
Cross-workspace semantic model sharing limitations: External users may not be able to access semantic models shared across workspaces unless specific configurations are enabled. This is especially true if the model resides in a workspace they don’t have access to.
- RLS and external user propagation: Even if the RLS script is correct and the external user security group (SG) has read access, the model may not properly propagate RLS filters across workspaces for external users.
- Semantic model sharing preview: Microsoft currently supports external semantic model sharing as a preview feature. If this isn’t enabled or configured correctly, external users may see blank data.
- Workspace permissions mismatch: External users might have access to the report but not to the underlying dataset in Workspace B, causing the data to appear blank.
SOLUTIONS:
- Enable semantic model sharing preview
Go to Power BI Admin Portal and ensure the “Allow external guest users to access semantic models” setting is enabled. - Verify workspace permissions
Confirm that external users have at least Viewer access to Workspace B where the dataset resides. - Use in-place semantic model sharing
Instead of relying on cross-workspace links, publish the dataset directly into the same workspace as the report or use in-place sharing to ensure access continuity. - Test with simplified RLS.
- Use same workspace for report and model
As you’ve already tested, publishing the dataset to the same workspace as the report resolves the issue. This suggests that cross-workspace sharing is the blocker.
- v-kpoloju-msft
Hi Kalyan228,
Have you reviewed the latest reply provided by Zanqueta, anilgavhane. If the guidance shared was helpful, that's great and it may assist others with similar questions. If you need anything else or have more questions, feel free to reach out.
Thank you for using the Microsoft Fabric Community Forum.- v-kpoloju-msft
Hi Kalyan228,
Just checking in to see if the issue has been resolved on your end. If the earlier suggestions helped, that’s great to hear! And if you’re still facing challenges, feel free to share more details happy to assist further.Thank you.