Authenticate with G Suite

[xmark]

Hi everyone, I am looking to roll-out PowerBI into my organisation who currently uses Google GSuite as their primary business suite of tools and SSO for most our SaaS products.

I was trying to find some documentation online about how we can authenticate into the Power BI Service using G Suite authentication (SAML/SSO) but not having any luck.

Does anyone know how we would go about using a different authentication provider like Google GSuite to authenticate into app.powerbi.com ? Is it possible? If not, what are my options here?

Thanks.

[erolyil]

Hi, I am also trying to find a way to authenticate into the Power BI Service using G Suite authentication since most of our users reside in G-suite. Could you find a way to succesfully do that? I read the federation document and it says users can be authenticated as guests. Are there any disadvantges for being authenticated as guest?

Best regards,

[xmark]

hi again @v-robertq-msft 

I wanted to update you on my progress as well as ask a few more questions...

Firstly, you CAN indeed authenticate into app.powerbi.com using Google G Suite - this is achieved using Direct Federation https://docs.microsoft.com/en-us/azure/active-directory/external-identities/direct-federation

I had setup my federation with my org's G Suite account, then invited my google user into my Azure Ad tenant (using the B2B flow) - my google user was sent an email - asking them to accept the invitation and that seemed to all work fine (this logged the user into https://myapps.microsoft.com/ - NOT app.powerbi.com)

I could not figure out how to force the Power BI Service to use an external IdP to authenticate into app.powerbi.com - this was extremely frustrating as I was so close.

So I logged into Power BI Service using my other (non-google) Office 365 account, created a Power BI App - and then shared the App with my Google User (added them on the "app publish" screen)

I then attempted to provide the direct app link:

https://app.powerbi.com/Redirect?action=OpenApp&appId=APP_ID&ctid=TENANT_ID

to the google authenticated user

This also failed - the login flow did not recognise my google domain account.

However, something VERY strange happened next, when I manually navigated to app.powerbi.com - I was bounced to the traditional Microsoft "account chooser" screen - (e.g. which account do you want to login as) - and to my surprise - my google account session was lised as "logged in"

So I clicked that account, and I was successfully logged in to the app!!!

I verified this by looking at the account details, and I can 100% confirm that I was logged in with my google user account into the Power BI Service.

My outstanding question is that most microsoft applications have a direct URL for logging in using an IdP - what is that URL for the Power BI Service?? I cannot find it documented anywhere.

[v-robertq-msft]

Hi, @xmark 

You can check these cases that are related to the problem you posted and find if it’s helpful:

https://community.powerbi.com/t5/Service/Need-to-know-if-G-suite-users-can-login-to-Power-BI-service...

https://community.powerbi.com/t5/Desktop/Question-about-Single-Sign-on-SSO-from-G-Suite-to-Organizat...

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[xmark]

Thanks @v-robertq-msft - I did see those, but some are quite old and others were a little non conclusive. However, looking into the roadmap items, there certainly isnt anything in there regarding this.

Im wondering if there is broadly anything like this out in the wild you have seen done? Surely, there is some pathway to use our own user directory and not force everyone in the company to have 2 accounts to manage?