We’re starting to collaborate with several outside vendors, and I need a clear strategy for managing their access to our Power BI workspaces. Should I be adding them directly as guest users in Microsoft Entra ID (formerly Azure AD), or is there a way to handle this entirely within the Power BI service? I'm particularly concerned about security, licensing requirements for these external folks, and whether they should have workspace roles or if we should just use Apps.
3 answers
For a professional setup, you should definitely use Microsoft Entra B2B collaboration. Adding vendors as guest users in your tenant is the most secure method because it allows you to apply Conditional Access policies and MFA. Regarding the "where" to give access: avoid giving external users direct workspace roles like Member or Contributor unless they are co-developing. For most vendors, publishing a Power BI App is the best way to go. It provides a clean, read-only interface and hides the underlying datasets. Also, remember that if your workspace isn't on Premium capacity, those external users will need their own Pro licenses or you'll have to assign one to their guest account in your tenant.
I've seen some people mention that you can just share a report link directly without the Azure setup. Is that actually a viable long-term strategy for a growing company, or does it become a nightmare to audit who has access to what as the vendor list grows?
Stick to Power BI Apps for external consumption. Workspace access is too "open" for outsiders. Apps let you control exactly which reports they see while keeping the workspace for your internal dev team.
Spot on, Michael. I’d add that if you use the Viewer role in a workspace for them, you can also leverage Row-Level Security (RLS). This ensures that even if two different vendors are looking at the same report, they only see the data rows specific to their own company’s performance.
That is a recipe for a security audit failure, Thomas. Direct sharing via links (ad hoc invites) technically works, but it creates "shadow" guest accounts that are hard to track. By using Entra B2B, your IT team can manage everything in a central directory. If a vendor contract ends, you disable one account in Entra and all their Power BI access across all workspaces and apps vanishes instantly. It’s much more scalable than chasing down individual report links.