App Not Installing For External Viewers

[ScottieLobster]

Hello, I'm looking for some advice on the following:

I am receiving the error: ServerError_PowerBINotAuthorizedException when having an External User try to connect to a Power BI app link. 

The Status Code is 401.

I have a composite model with RLS on the bottom layer of datasets. 

I've tested the RLS in both Desktop and Service and this works as expected. 

I have updated the App and confirmed the correct link is being sent. 

I have cross-referenced the Share > Copy Link results from each Audience. These all appear to be identical. 

Model:

The team I'm working with have several datasets that are fed by a dataflow. (Level 1)

The dataflow pulls from a SQL Database. 

The datasets have been put together in pbix files in Desktop. 

These datasets are then joined via DirectQuery into another pbix to create a "composite model". (I think this is the correct term: Use composite models in Power BI Desktop - Power BI | Microsoft Learn) (Level 2)

There are then reports in pbix files built on the composite models. (Level 3)

These reports are then published into an app. 

App: 

There are various Audiences - the one they wish to share with the external users has the Entra ID security group assigned to it.

The Entra ID Group is not given access anywhere else aside from being assigned to the Security Role on the semantic models.  

Entra ID Group:

This was created with a "Bulk insert" csv, without sending an invitation link to the users. 

The B2B status is Accepted for the external user that is making the initial tests. 

Row Level Security (RLS): 

I have applied the RLS on the earliest/lowest level of datasets (Level 1). This is a SWITCH statement that uses a CONTAINSSTRING function on the USERPRINCIPALNAME(). This is applied in all Level 1 datasets, both in Desktop on the pbix files and the corresponding Entra ID group is added in Service, going via Settings > RLS Role. 

I have checked and validated the RLS. 

Any help is greatly appreciated. 

[v-nuoc-msft]

Hi @ScottieLobster

A status code of 401 usually indicates an authorization issue, which can arise from a number of potential causes. Please try the following to resolve the issue:

Licenses and Permissions:

Verify that the external user has the appropriate Power BI license. If you are using Power BI Premium, make sure the workspace where your app is located is assigned Premium capacity.

Verify that external users have been granted access to the app. You can check this in the Power BI service by navigating to the app's workspace, selecting Access, and making sure the Entra ID security group containing external users is listed.

Invitation and consent:

Make sure external users complete the consent process after being invited to join the organization. They should have clicked to agree to the experience to access the content.

Row Level Security (RLS):

Double-check the RLS configuration in the Power BI service to ensure that the Entra ID group is correctly assigned to the RLS role and that the rules are implemented correctly.

Apply sharing settings:

Review the app sharing settings to make sure the app is configured to allow sharing with specific Entra ID security groups. You can find this under "Permissions" in the app settings.

External collaboration settings:

Check the external sharing settings in Power BI and Microsoft Entra to confirm that they are configured to allow external users to be invited and access content.

Redeem invitation:

Since the B2B status is "Accepted," there's less chance of an issue redeeming the invitation, but it's worth confirming that external users are using the correct link to access the app.

You can view the link below for more details:

Solved: PowerBI API Returns "PowerBINotAuthorizedException... - Microsoft Fabric Community

Distribute content to external guest users with Microsoft Entra B2B - Power BI | Microsoft Learn

Regards,

Nono Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[ScottieLobster]

Hi Nono Chen,

Thanks for taking the time to reply. 

Replies to your thoughts below. I will look for answers to the questions I've supplied below but any further direction would be very helpful. 

I have accessed both supplied links in trying to troubleshoot this myself but I've not been able to find a solution in these. 

Licenses and Permissions:

The Workspace has Premium capacity. 

Verify that external users have been granted access to the app. 

The correct Entra ID group has been added to the relevant audience in the app. 

Invitation and consent:

Make sure external users complete the consent process after being invited to join the organization. They should have clicked to agree to the experience to access the content. --> how can I check this?

Row Level Security (RLS):

Tested RLS with multiple User Principal Names in both Desktop and Service - all filter correctly and as expected. 

Apply sharing settings:

Review the app sharing settings to make sure the app is configured to allow sharing with specific Entra ID security groups. You can find this under "Permissions" in the app settings. --> is this a global setting or a per App setting? Not sure what you're referring to here. (App > Manage Permissions shows that the Entra ID gropu has direct access.)

External collaboration settings:

Check the external sharing settings in Power BI and Microsoft Entra to confirm that they are configured to allow external users to be invited and access content. --> is this Admin Portal or Workspace specific?

Redeem invitation:

Since the B2B status is "Accepted," there's less chance of an issue redeeming the invitation, but it's worth confirming that external users are using the correct link to access the app. --> I've checked the link several times and confirmed that each Audience seems to have the same link. 

[ScottieLobster]

A new discovery from today: the documentation says that "Guest users can't install apps published to the entire organization" - link. 

There was one Audience in the App that was published to the entire organisation - although not the y one being given to the external team. 

I've adjusted this to "specific users and groups" to see if this helps. 

I'll update when I get feedback from the team. 

[ScottieLobster · Accepted solution]

This was partially successful!

I removed the Audience (1 of 3) that was published to the entire organisation. 

That has:

1. Allowed the external user to install the app. 
2. Access the app content. 
3. See some of the visuals contained in the app. 
4. Allowed the User Principal Name card visual to show that this value is being returned correctly. 

The remaining issues are: 

1. One page cannot load the model associated with the report. 
2. 5 of 10 pages return "Can't display the visual. See details" on all visuals.