Providing Workspace-Level and RLS Access to an External Vendor in Power BI

 Overview

Importance of granting both Workspace-Level Access and Row-Level Security (RLS) Access when onboarding an external vendor to Power BI. While workspace access enables the vendor to access Power BI content, RLS ensures they can only view the data that is relevant and authorized for them.

Why Both Access Levels Are Required

1. Workspace-Level Access

Workspace access determines what content a user can access within Power BI, including:

• Reports
• Dashboards
• Datasets
• Dataflows

For external vendors, the appropriate workspace role should be assigned based on their responsibilities:

Role	Capability
Viewer	Can view reports and dashboards
Contributor	Can create and edit content
Member	Can manage content and collaborate
Admin	Full workspace administration

In most vendor scenarios, Viewer access is sufficient unless the vendor participates in report development.

2. Row-Level Security (RLS)

RLS restricts data visibility within reports and datasets. Even when users have access to a report, RLS ensures they see only the rows of data assigned to them.

Example:

• Vendor A can view only Vendor A transaction records.
• Vendor B can view only Vendor B transaction records.
• Both access the same report, but data is filtered based on their assigned RLS role.

Implementation Approach

Step 1: Add External Vendor as a Guest User

• Invite the vendor through Azure Entra ID (formerly Azure Active Directory).
• Ensure the vendor accepts the invitation and can authenticate successfully.

Step 2: Grant Workspace Access

• Navigate to the required Power BI workspace.
• Select Manage Access.
• Add the external vendor account.
• Assign the appropriate role (typically Viewer).

Step 3: Configure RLS

• Create roles in Power BI Desktop.
• Define data filtering rules based on vendor identifiers.
• Publish the dataset to the Power BI Service.
• Assign the external vendor to the corresponding RLS role.

Step 4: Validate Access

• Test using View As Role functionality.
• Confirm the vendor can access reports.
• Verify only authorized data is visible.

Benefits

• Enhanced data security.
• Controlled access for external users.
• Compliance with governance requirements.
• Single report serving multiple vendors through RLS.
• Reduced report duplication and maintenance.

Key Takeaway

Granting only workspace access is not enough when sharing Power BI reports with external vendors. A secure implementation requires a combination of:

✅ Workspace-Level Access to access reports and dashboards.

✅ Row-Level Security (RLS) to restrict data visibility based on business requirements.

This layered security approach ensures external vendors can collaborate effectively while maintaining strict control over sensitive organizational data.