RLS for external B2C users

[Etsu0612]

I have Power pages portal in which the power bi report is to be embedded which has RLS applied dynamically using USERPRINCIPALNAME(). Now, this portal will be accessed by 1000s of external users who are setup as B2C in our organisation AD. My current org is ITSolutions.com and the external users are setup in ITSolutions.onmicrosoft.com. Now, how do I apply RLS to those external users?

[v-ssriganesh]

Hi @Etsu0612,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[v-ssriganesh]

Hi @Etsu0612,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-ssriganesh · Accepted solution]

Hi @Etsu0612,
Thanks for posting your query in Microsoft fabric community forum.

Firstly, I would like to acknowledge @pallavi_r for the helpful response regarding guest users (Azure AD B2B) that is indeed a common approach for external user access in Power BI.

However, as you’ve clarified that your external users will remain in Azure AD B2C and won’t be added as guest users in your organization's directory, your setup requires a slightly different approach to ensure RLS (Row-Level Security) works effectively when embedding Power BI content in your Power Pages portal. Below are some considerations:

• Since Azure AD B2C users authenticate through a separate identity provider, the behaviour of USERPRINCIPALNAME() may not align with standard Azure AD users.
• Instead, for Power BI Embedded scenarios, it is common to use an embedding approach with an "App Owns Data" model.
• You can generate an embed token for each external B2C user and pass their unique identifier (e.g., email, username, or a custom claim) using the Effective Identity property.
• Your RLS filter logic should then match this identifier against your data model, often using USERNAME() or a custom claim instead of USERPRINCIPALNAME().

For detailed guidance, you can refer to these articles:

• Row-Level Security (RLS) with Power BI Embedded

• Power BI Embedding (App Owns Data) Overview

If this helps, then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily. 
Thank you.

[v-ssriganesh]

Hi @Etsu0612,
I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.
Thank you.

[pallavi_r]

Hi @Etsu0612 

Yes, it can be done by adding guest user to azure active directory (MS Entra) and then send them an invite.

Detailed steps are provided in the link below:

https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-azure-ad-b2b

Thanks,

Pallavi

[Etsu0612]

Hi Pallavi, But the customer doesn't accept to add the external users as guest users in organisation's AD. Instead, they'll continue to be in B2C tenant.