Forum Discussion
RLS for External guest users
Hi BipinLala26 ,
According to the official documents, USERPRINCIPLENAME() name will return the UPN that looks similar to an email address at connection time. But they don’t have a clear statement about its format when accessing with external users.
Row-level security (RLS) with Power BI - Power BI | Microsoft Docs
USERPRINCIPALNAME function (DAX) - DAX | Microsoft Docs
However, with the following, you could notice that Power BI will return email address of the external users. Distribute Power BI content to external guest users using Azure Active Directory B2B - Power BI | Microsoft Docs
For guest user [email protected], only data that belongs to the rows fully matched with this value will be displayed for him. If there is a row whose value is Tim.Scott_domainName.com#EXT#@ourOrganization.onmicrosoft.com, it won’t be displayed for the user [email protected], which is be proved by test.
Therefore, if your MS Graph API returns email address([email protected] but not Tim.Scott_domainName.com#EXT#@ourOrganization.onmicrosoft.com) of the external user, then you could take it as UPN. Conversely, you couldn’t get your expected result.
If there is any post helps, then please consider Accept it as the solution to help the other members find it more quickly. If I misunderstand your needs or you still have problems on it, please let me know. Thanks a lot!
Best Regards,
Community Support Team _ Caiyun
Hi BipinLala26 ,
According to the official documents, USERPRINCIPLENAME() name will return the UPN that looks similar to an email address at connection time. But they don’t have a clear statement about its format when accessing with external users.
Row-level security (RLS) with Power BI - Power BI | Microsoft Docs
USERPRINCIPALNAME function (DAX) - DAX | Microsoft Docs
However, with the following, you could notice that Power BI will return email address of the external users. Distribute Power BI content to external guest users using Azure Active Directory B2B - Power BI | Microsoft Docs
For guest user [email protected], only data that belongs to the rows fully matched with this value will be displayed for him. If there is a row whose value is Tim.Scott_domainName.com#EXT#@ourOrganization.onmicrosoft.com, it won’t be displayed for the user [email protected], which is be proved by test.
Therefore, if your MS Graph API returns email address([email protected] but not Tim.Scott_domainName.com#EXT#@ourOrganization.onmicrosoft.com) of the external user, then you could take it as UPN. Conversely, you couldn’t get your expected result.
If there is any post helps, then please consider Accept it as the solution to help the other members find it more quickly. If I misunderstand your needs or you still have problems on it, please let me know. Thanks a lot!
Best Regards,
Community Support Team _ Caiyun
This was a good conversation but we learned it hard way:
Steps for External users to see Internal Dashboard:
1. Azure Admin send the invitation to extenral users via Azure Active Directory (AAD).
2. USers accepted the invitation. So they are in the system.
3. This step helps that they can see the dashboard.
4. Now for RLS: Add them in the “Security” section RLS of Power BI Dataset in service as their EXT email. As that’s the only one is coming from Active Directory.
5. On the BW side, add their actual email address than the EXT email.
6. When User logs in to the service, they log in as their actual email hence the step 5 helps on the RLS side.
The step 5 was crucial in our scenerio.Thanks.
on Step #5 what is BW?
