Row Level Security - External User

[powerbieng]

Hi Everyone,

We published our report in Power BI Service and will share the report with external users. How RLS security can be implemented for an external user.

If we add external users details into tables(like normal users) and using USERPRINCIPALNAME() will work?

any other configurations required?

Please guide us.

Thanks 

Thanks

Venkat

[Raveendra]

Hi 

We have to add external users Security group(which is created in Azure portal.) to RLS role . Because users frequently changed dynamically every one hour.

when we tried to SG to role showing " you can t use invalid or duplicate emails" .  I can create distributon group/Mail enabled group  in idweb internal tool ,but it was not  allow to add external users to DL.

in the RLS documention mentioned ROL role supports below mentioned list of Groups.

• Distribution Group
• Mail-enabled Group
• Security Group

Can you please help me any one came across this kind of issue and let me know if i missing somehting here.

Earliest response will be apperciated ....

Thanks,

Raveendra

[GilbertQ · Accepted solution]

Hi there

You would first need to add the external user as part of your AAD, and then assign them access to your dataset, by going into the dataset settings and then clicking on Security.

Here are more details on how to do this. Scroll down to the section, which will explain how to achieve this.

https://docs.microsoft.com/en-us/power-bi/whitepaper-azure-b2b-power-bi#case-study-building-a-bi-por...

[jontybadamwala]

Hello,

Will they require to have Power BI Pro License?

We are dealing with an issue here, hence the questions.

We have publised a report using our Power BI Pro license, to 15 users in our organization.

Some of the users (out of the 15) have Power BI Pro license, and they are able to view the shared report.

User who do not have the Power BI Pro Licesne, they are unable to view the report,

What should be done?

Thanks

Jayanti V Badamwala

[u02cm62]

Yes, it does require some sort of PBI license.  Either backed by Premium capacity or Pro licenses for internal users.  The customer can have their own Pro license as well.

[u02cm62]

if it's pointed to Azure Analysis services you need to use CustomData(), but if you were using SSAS on premise, then it's UserPrincipalName, just the format/syntax of the external user is different for Azure AD vs AD (FYI).

[GilbertQ]

Hi there

I would just like to correct if you are using SSAS On Premise it does not know or understand the UserPrincipalName() and only works with Domain\UserName

If you do have an SSAS On Premise database, then you need to use the mapping feature in the Gateway configuration.

If you are using Azure Analysis Services, then it will understand and you can use the UserPrincipalName()

[u02cm62]

Actually, we do not map any user when using SSAS.  We use email, which is equivalent to UPN.  We have been working with customers since 2016 on SSAS and also using AAS custom data.

[Greg_Deckler]

Should work using USERPRINCIPALNAME although there may be a slightly different format to that.