RLS, B2B and Analysis services issue

[tysklind]

Hi

I have my azure subscription in DomainA.com and my Powerbi.com in a DomainB.com.

I have :

1. Created a guest invite to user x.y@domainB.com in domainA.coms Azure AD.

2. Then I have tried to add  x.y@domainB.com to a role in Azure Analysis services (domainA.com)

3. I cannot find x.y@domainB.com but I find x.y_domainB.com#EXT#@domainA.onmicrosoft.com

4. I add this account to the role 

5. I cannot see any model in either excel or PowerBI. 

I can put a manual entry in the analysis services role and that works. But I would like to use AAD groups in the role and handle all administration within AAD. Does anyone have any ideas?

Thanks in advance!

[v-shex-msft]

HI @tysklind,

I'd like to suggest you take a look at official document.

Considerations and Limitations

• When you invite guest users that are using personal email accounts such as gmail.com, outlook.com, or hotmail.com you can follow this embedded video to see an example of how a user would sign up.
• External B2B guests are limited to consumption of content only. External B2B guests can view apps, dashboards, reports, export data and create email subscriptions for dashboards and reports. They can't access workspaces or publish their own content.
• This feature is not currently available with the Power BI mobile apps. On a mobile device, you can view Power BI content shared using Azure AD B2B in a browser.
• Using guest users with Power BI is not supported within sovereign clouds (government).

As document said, current these guest users can't edit on external workspaces.

Regards,

Xiaoxin Sheng

[tysklind]

Hi @v-shex-msft,

Thanks for your reply.

When I'm creating the the reports and connecting to the data source (AAS), i'm using an account from domainA (the domain that holds azure/analysis services). That works fine. 

When I publish the report to domainB's PowerBI. I cannot access the data. 

Is B2B only for enviroments where PowerBi and analysis services is in the same domain and you are inviting external persons to that domain? 

[v-shex-msft]

HI @tysklind,

>>Is B2B only for enviroments where PowerBi and analysis services is in the same domain and you are inviting external persons to that domain? 

According to your description, I think it may related to 'effective user name'. After you setting guest users, power bi will assign these users as'x.y_domainB.com#EXT#@domainA.onmicrosoft.com'.

In my opinion. I'd like to suggest you try to setting UPN to replace specific string(_domainB.com#EXT#) to help azure find out correspond effective user name.

User Principal Name (UPN) Mapping in Power BI

Regards,

Xiaoxin Sheng

[tysklind · Accepted solution]

I think I found the answer. I needed to create a new SSAS Service in Azure. Then everything worked smoothly. I think that my old SSAS enviroment has not been patched correctly by Microsoft

[GilbertQ]

Hi @tysklind

This can be done, and I would suggest following this video from Guy In a Cube

https://www.youtube.com/watch?v=Q9f46gAv3Fo&list=PLv2BtOtLblH19Pp_DYpVXYUI0m8D0nDgd

You can also do it by adding the guest user into an Azure Active Directory Security Group, and then putting this group into Azure Analysis Services?