Power BI / Embedded: Licencing / Permission questions (Azure AD)

[TomE]

Hello all,

I do have some licencing/permission questions regarding PowerBI / PowerBI Embedded in concern of Azure Active Directory.

Our setting:

1. we do have a company related Azure AD with Office 365 / PowerBI licenses (companyname.com).
2. we do have all our technical Azure Resources using a different Azure AD (xxx onmicrosoft.com). Some user Accounts from 1. are added there as Guest-Accounts.
3. we have our PowerBI Embedded environment set up (in 2.). A technical user from 2. ist set as Administrator (PowerBI Trial).
4. some Guest Users from 2. having a valid PowerBI licence in their "home"-ActiveDirectory (1.) are configured as PowerBI Workspace Administrators.

Problems:

• The Guest Users (see 4. above) somehow do not have Edit-Permission on the reports in their PowerBI Workspaces (they are set Administrator).
• I don't know how to promote the technical PowerBI User (see 3.) from trial to a proper PowerBI Pro Licence. I can't add this license in 2.

General question:

We want to offer Power-BI Embedded functionality to customers of our SaaS-Software. Users should be able to see reports, but Power-Users should be able to create and modify reports.
Our goal would be, that we add those "Power-Users" as external users to our technical Azure AD (see 2.) and assign them as Administrators for their tenant workspace.

Is this possible at all?

Regarding Power BI Pro licences - we see following scenarios:

• User does not yet own a PowerBI Pro licence -> we buy/assign it in our AD (2.).
• User already owns a PowerBI Pro licence -> he should be able to use it in our environment as well (actually this does not seem to work (see 4.)).

Does this concept work at all or what has to be done to support this?

Thank you for your help!

Regards

[Seth_C_Bauer]

@TomE If you are using embedding in an application is there a reason you haven't spoken about the licensing for embedding? With an embedded "A" sku, you should be able to license all the end users without directly mapping any credentials to your internal AD. You would just need to create seperate workspaces for those users to have access to, and the App should be able to handle the rest... The end users don't need a seperate license to create or edit reports if you light up that functionality in the embedded application. The only downside of that approach is any person with edit rights could modify anything in that workspace. 

[TomE]

@Seth_C_Bauer thanx for your quick response.

Actualy you are right - I was not aware of automatically owning an “edit”-licence in an Embedded-scenario. I thought I read differently on some site.

Just some additional questions:

1. This “edit”-licence in embedded mode would not cover editing in the PowerBI Desktop App or using the “app.powerbi.com” interface?
2. Our goal would be that customers can fully customize their reporting/dashboards – including connecting our application data with data they might have in own sources (meaning adding own custom datasources). Am I right that existing embedded libraries won’t cover this functionality out of the box and this would need to be implemented from scratch by the application?

Regarding my questions in the Active Directory scenario – it sounds like you would not recommend going this way?

Thank you for your response!

[Seth_C_Bauer · Accepted solution]

@TomE 1) - Correct. 2) whew... I haven't thought through the whole "bring you data" scenario, but this is ugly. I am not aware of how you would do this in the App, let alone outside the app. Even with full guest permissions inside your Power BI Service tenant the external users can't publish to that workspace... It psuedo gives them admin access.. it only allows them to work with the workspace from within the Service/workspace of that tenant and they can't connect via their own Desktop without domain credentials. That aspect I have looked into, and I am not aware of any workaround to give full access to someone in a different tenant.