Forum Discussion
Securely sharing Power BI reports with external users: difficult process
Hi. We have some Power BI reports that we would like to share outside the organisation, but with named users only. We are fortunate to have Premium Capacity, so we can use the Secure Embed functionality to authenticate those users’ own email addresses with our organisation as guests (sharing publicly via Publish to Web is not an option for this content). Specifically, we’re following the planned invite instructions.
This process works for some external users, but we have two problems:
- Users who use domains that Microsoft considers personal, e.g. Gmail.com, Outlook.com, are forced to register with an organisational account. The quick start example doesn’t mention this. Some are unwilling to do so, as they legitimately wish to continue using their preferred provider to access content from our organisation. In addition, this request makes an already suspicious-looking process look even more like phishing. We provide instructions before sending the invitations, but are finding that some users still baulk at jumping through all the hoops.
- Some organisations have blocked this kind of sharing altogether, making it difficult to securely share any content at all through the Power BI Service. Users receive the following error when they accept the invitation: “Your network administrator has blocked access. External access is blocked by policy. Contact your IT department for access.”
So even after committing to Premium Capacity, we’re running into these kinds of hurdles to sharing outside of the organisation. Has anyone else managed to find an effective way to easily and securely share their PBI content externally? For instance, is there any way to pre-approve users so that an invite to view a report ‘just works’? The planned invite process requires going through the whole consent experience, with the issues noted above. Are there configuration options in Azure or Power BI that we should be considering?
With thanks, Drew
Hi drewbios
- Guest users who use this capability should have a work or school account.
- If the guest user's organization have blocked the invite, that may caused by this issue:
Organization can't set up an allowlist abd a blocklist together. By default, whatever domains aren't in the allowlist are on the blocklist, and vice versa. you can connet the admin to add your organization to allowlist.
Besides, Power BI embedded analytics may helps you. Power BI embedded analytics offers two solutions:
The embed for your customers solution allows you to build an app that uses non-interactive authentication against Power BI. Your customers are likely to be external users, and they don't need to sign in using Power BI credentials to view the embedded content. Typically, this solution is used by independent software vendors (ISVs) who are developing applications for third parties.
Embed for your organization
The embed for your organization solution allows you to build an app that requires signing in using Power BI credentials. Once signed in users can only consume embedded content, they have access to on Power BI service. This solution is aimed at large organizations that are building an app for internal users.
For more details, please refer to:
Considerations and Limitations of External Guest Users| Microsoft Docs
Allow or block invites to specific organizations - Azure AD - Microsoft Entra | Microsoft Docs
Power BI embedded analytics overview - Power BI | Microsoft Docs
Best Regards,
Jianbo Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
- Guest users who use this capability should have a work or school account.
3 Replies
- v-jianboli-msftCommunity Support
Hi drewbios
- Guest users who use this capability should have a work or school account.
- If the guest user's organization have blocked the invite, that may caused by this issue:
Organization can't set up an allowlist abd a blocklist together. By default, whatever domains aren't in the allowlist are on the blocklist, and vice versa. you can connet the admin to add your organization to allowlist.
Besides, Power BI embedded analytics may helps you. Power BI embedded analytics offers two solutions:
The embed for your customers solution allows you to build an app that uses non-interactive authentication against Power BI. Your customers are likely to be external users, and they don't need to sign in using Power BI credentials to view the embedded content. Typically, this solution is used by independent software vendors (ISVs) who are developing applications for third parties.
Embed for your organization
The embed for your organization solution allows you to build an app that requires signing in using Power BI credentials. Once signed in users can only consume embedded content, they have access to on Power BI service. This solution is aimed at large organizations that are building an app for internal users.
For more details, please refer to:
Considerations and Limitations of External Guest Users| Microsoft Docs
Allow or block invites to specific organizations - Azure AD - Microsoft Entra | Microsoft Docs
Power BI embedded analytics overview - Power BI | Microsoft Docs
Best Regards,
Jianbo Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
- Guest users who use this capability should have a work or school account.
- drewbiosFrequent Visitor
Hi Jianbo, it looks like creating our ownembedded analytics app is the only way around the restrictions in place. Thanks for the info and links. Drew
- ShiftAnalyticsHelper I
You could also consider using a plug'n'play white label solution like the Reporting Hub: https://thereportinghub.com. It allows you share to external users by taking advantage of Power BI Embedded without any development complexity. You can create your own portal for sharing and delivering Power BI content. Deploys in minutes and no code required.