Forum Discussion
RLS for external B2C users
Hi Etsu0612,
Thanks for posting your query in Microsoft fabric community forum.Firstly, I would like to acknowledge pallavi_r for the helpful response regarding guest users (Azure AD B2B) that is indeed a common approach for external user access in Power BI.
However, as you’ve clarified that your external users will remain in Azure AD B2C and won’t be added as guest users in your organization's directory, your setup requires a slightly different approach to ensure RLS (Row-Level Security) works effectively when embedding Power BI content in your Power Pages portal. Below are some considerations:
- Since Azure AD B2C users authenticate through a separate identity provider, the behaviour of USERPRINCIPALNAME() may not align with standard Azure AD users.
- Instead, for Power BI Embedded scenarios, it is common to use an embedding approach with an "App Owns Data" model.
- You can generate an embed token for each external B2C user and pass their unique identifier (e.g., email, username, or a custom claim) using the Effective Identity property.
- Your RLS filter logic should then match this identifier against your data model, often using USERNAME() or a custom claim instead of USERPRINCIPALNAME().
For detailed guidance, you can refer to these articles:
If this helps, then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily.
Thank you.
Hi Etsu0612,
Thanks for posting your query in Microsoft fabric community forum.
Firstly, I would like to acknowledge pallavi_r for the helpful response regarding guest users (Azure AD B2B) that is indeed a common approach for external user access in Power BI.
However, as you’ve clarified that your external users will remain in Azure AD B2C and won’t be added as guest users in your organization's directory, your setup requires a slightly different approach to ensure RLS (Row-Level Security) works effectively when embedding Power BI content in your Power Pages portal. Below are some considerations:
- Since Azure AD B2C users authenticate through a separate identity provider, the behaviour of USERPRINCIPALNAME() may not align with standard Azure AD users.
- Instead, for Power BI Embedded scenarios, it is common to use an embedding approach with an "App Owns Data" model.
- You can generate an embed token for each external B2C user and pass their unique identifier (e.g., email, username, or a custom claim) using the Effective Identity property.
- Your RLS filter logic should then match this identifier against your data model, often using USERNAME() or a custom claim instead of USERPRINCIPALNAME().
For detailed guidance, you can refer to these articles:
If this helps, then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily.
Thank you.
Hi Etsu0612,
I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.
Thank you.