Help with sharing and permissioning for an outside org

[lmhinson]

Hi all. I'm new here and new to Power BI, but have a very complicated and time-sensitive puzzle to figure out.

Scenario: We are building a report for another company that needs to be shared with 1000(ish) of their employees and permissioned based on org structure. Essentially survey results/scores that will need to be gated based on user.

Question 1: Is there a realistic way to create this and share from my company's Power BI account? Not sure it's possible to add 1000-plus external users as guess users in our active directory and there are sharing limits on reports, correct? Alternatively, do I need guest user access into their Power BI account to be able to share this in any reasonable way? Not positive they will allow this, but I'm starting to think this might be required.

Second big question: How would you set up permissioning of content based on org structure? Overall executives would see the entire report – all pages and slicers. Then everyone underneath would only see their direct reports – regional manager would see all of their DMs and their reps. DMs would just see their reps, etc. Dynamic role-level permissioning? URL parameter filters (using embed URL if I can build this in their account)? 

Thank you so much! 

[GilbertQ · Accepted solution]

Hi @lmhinson 

By far the easiest way is for you to get an account within the external company. This will allow you to work within their organization with their data.

For your second question what you are looking to use is Dynamic Row Level Security. Here are some blog posts to look into to help you solve your challenge that based on the users they can only see what they should see.

Dynamic Row-Level Security in Power BI with Exclude and Include Rules - RADACAD

[GilbertQ · Accepted solution]

Hi @lmhinson 

By far the easiest way is for you to get an account within the external company. This will allow you to work within their organization with their data.

For your second question what you are looking to use is Dynamic Row Level Security. Here are some blog posts to look into to help you solve your challenge that based on the users they can only see what they should see.

Dynamic Row-Level Security in Power BI with Exclude and Include Rules - RADACAD

[lmhinson]

@GilbertQ Thank you so much for that confirmation and the link to the blog posts. Trying to read as much as possible about RLS, but in the meantime, could you possibly help with a guest access question? Do you know of a way for the client to give me guest admin access to one workspace only? To help with any security concerns on their part. And as a guest user, will I be able to use power BI desktop and publish from there to their service? I just read something that made it sound like a guest user wouldn't be able to do that. Or are you suggesting I would need an actual company account (with company email address) as opposed to being invited as a guest? Thank you!

[GilbertQ · Accepted solution]

Hi @lmhinson 

You now can actually add a guest account and there are a few steps that need to be configured. It does work but not as well as a user account in the same tenant.

Here are all the details on how to allow cross tenant sharing: Introducing Cross-tenant Power BI Dataset Sharing | Microsoft Power BI Blog | Microsoft Power BI

[lmhinson]

Thanks @GilbertQ . Working on getting a user account with client. I'm sure I'll be back to this community soon to get more answers 🙂