Issue with sign on Power BI using gmail account

[s168635]

I have a report need to share with external users, not all of them have work/school email, so I invite them to use gmails.

It worked fine before, after user registered gmail with Microsoft, but recently some users run into sign on issue.

When they open the shared URL: https://app.powerbi.com/groups/bca2e794-XXXXXX/reports/7274399f-f88c-YYYYY?ctid=9d418695-71ac-4c31-Z...

Sometimes system redirect user to https://login.microsoftonline.com/xxxxxxx, which will allow user to sign on with their gmail;

Other time redirect to https://powerbi.microsoft.com/xxxxxx, which will only take school/work email.

Anyone else had the same issue? What could cause the different re-direct sign on?

Thanks,

BW

[miken72]

Hello,

We seem to have a similar issue with users with Gmail addresses having problems viewing report results.

We are testing running Power BI server Premium.
We have an Power BI app that contains reports.
Each report uses RLS to limit the results according to what the account/email adress that requests to see it is allowed to see.
This RLS has been tested in the Power BI cloud workspace and works fine with office365 email adresses (internal and external to our organisation) and even with Gmail addresses that we have registered in our Azure AD, and also in each Power BI report, and in the RLS roles settings for each dataset up in the cloud workspace.

The problem occurs when a test user with a Gmail address (that, again, is registered in our Azure AD and is in the RLS for the datasets of the reports in the Power BI app) connects to the app from their Mac. They get into the Power BI app ok (so we can confirm that the user is trying to access the app using the correct Gmail address) but then get error messages when they click on the reports that their email addresss/account does not have the permissions to view the data in the underlying datasets.
Again, this has been tested and works fine in the cloud workspace - when one selects a dataset -> security ->RLS -> test as role so that Gmail address sees the results it is allowed to see.  


Were your Gmail users also able to access the reports but not see the results?

[s168635]

I did not test further - just told my users to use Gmail with caution and I could not trouble shot any issue due to lack of support.

[miken72]

Hello,

From further testing I think that the problem is that the email address of the user requesting the report in the app has a prefix added onto it depending on which Web browser or type of computer the request is sent from.

I added a card which shows the value of the userprincipalname variable into my test report in my app, so when our testusers access the app they can see their email (of which is being used to access the test report in the app).

I tested accessing the test report in the app with a Gmail account using a PC and MS Edge as the Web browser and my email address was displayed as mail#<mygmailaddress@gmail.com> (so, with a prefix of "mail#")

Then we tested accessing the report in the app with a gmail address but using a Mac and Safari as teh Web browser, and the displayed email had a prefix of "live.com#" infront of the user's gmail emial address.

There were no prefixes infront of the users'  emails when testing using Office365 email addresses (using a PC and MS Edge).

This seems to be creating the problem, as these users' emails with prefixes do not match the email addresses we have in the database tables that are used in the test report to set Row Level Security (i.e. to define which data a user will be able to view when the report is run).

When I changed a Gmail address in the RLS database tables that the test report uses so that it had the prefix "mail#" and tested accessing the test report in the app again it worked fine - the test report showed only the results that the user was permitted to see.

We have more testing to do.  
An idea I wil try is to strip the userprincipalname variable value of any prefix in the Manage Roles DAX expression in the test report, in other words, update this statement to strip any prefix from the variable when comparing it to the [Emailadress] field in the table that is used by the test report to do RLS.

Report_Users[Emailadress] = userprincipalname()

This is just a theory right now, and it may not be the users' computers or Web browsers that are causing these prefixes to be added to the users' emails when they request to view the report in the app - it could be happening in Azure AD (another team manages Azure here so I am in contact with them to look into this).

Maybe this will help save some time for anyone also experiencing this issue.

[s168635]

The different prefixes indicate different authentication paths: I don't have a Mac now but previously I could not sign on with Gmail on a Mac, it throw an error like "404 invalid URL" or such, maybe it is fixed now.

I believe it was like: live.com# is using https://login.microsoftonline.com/xxxxxxx, mail# is using https://powerbi.microsoft.com/xxxxxx.

But anyway, Microsoft will not support it, so ...

[v-robertq-msft]

Hi, @s168635 

According to your description, the end-users used a Gmail account to sign in to the Power BI and open the report using the link you shared with them.

In my opinion, Power BI doesn’t support you to sign up using email addresses provided by consumer email services or telecommunication providers, like outlook.com, gmail.com. Therefore, if they use a Gmail account to register and log in to Power BI, then the error is inevitable.

Here are some ways to avoid this problem, you can check if they can be useful:

When we log into Power BI,  https://login.microsoftonline.com is the login page we will go to. They can try to go to this site to sign in their accounts to Microsoft first and open the link you shared with them. Maybe this way can make them log in normally.

We prefer you to log in with your school or work account. If they don’t have any work or school account, we recommend the end-users to sign up for a Microsoft 365 trial of office, you can follow this document:

https://docs.microsoft.com/en-us/power-bi/admin/service-admin-signing-up-for-power-bi-with-a-new-off...

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[s168635]

Thank you.

I tested more later, so far all the errors happened on MacOS and no issue with PC(Edge/Chrome/Firefox), had same issue on PC/Opera, which was fixed by sign on to https://login.microsoftonline.com first and open a new tab to shared URL.

You may want to re-produce the issue on a Mac by sharing a report to a gmail address. My report worked fine with gmail account prior to the week before, so it might have something to do with recent MacOS update or Power BI update but I have no way to tract that.

Some of them run into below error message, which doesn't make sense at all:

This login.live.com page can’t be found because no website can be found for the page https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88- ....

In my case, sometimes I will have to use their gmails, school/work email, or 365 trail are better but just not practical for certain users,

Thanks again,

BW

[v-robertq-msft · Accepted solution]

Hi, @s168635 

Unfortunately, I guess that this problem can’t be informed as an issue that existed in Power BI, because the Gmail account is described as unsupportable in the Power BI professional document.

You can raise a new idea in the Power BI Issue, and check what’s their opinion on this issue.

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.