- People outside your company get to reports as guests in your tenant, through your own app with embedded Power BI, or through Publish to web, which is public to anyone on the internet.
- A guest needs a Pro or PPU license unless the content sits on an F64 or larger capacity, where a Free license is enough. A customer in an embedded app needs no license, but the report has to sit on a capacity.
- Embedding in your own app means an app that signs customers in, issues embed tokens and controls who sees which data.
Contents 7 sections
- 01How do you show a Power BI report to people outside your company?
- 02Sharing with external users as B2B guests
- 03Power BI Embedded and app owns data
- 04Capacities for embedding: A, EM and F
- 05Power BI Embedded licenses: who needs which?
- 06What the app around it must do
- 07FAQ
How do you show a Power BI report to people outside your company?
There are three ways to make a report available to a customer, supplier or partner. They differ in who signs the reader in and which license the reader needs.
Three routes to external readers
| Path | Who signs the reader in | Reader's license |
|---|---|---|
| Guest in your tenant, B2B | Microsoft Entra ID, the reader has a guest account | Pro or PPU; on an F64 or larger capacity, Free is enough |
| Embedding in your own app, app owns data | your app, in its own way | none |
| Publish to web | nobody | none, the report is public |
Publish to web makes a report public to anyone on the internet, without signing in. Microsoft warns that a reader can then also get detailed data from the model that the report itself doesn't show. Reports with row-level security can't be published through Publish to web, and an administrator has to enable the feature in the tenant (Publish to web).
There's also embedding for your own organization, which Microsoft calls embed for your organization or user owns data. The report is embedded in a company app, each reader signs in with their own Entra ID account and needs a Power BI license. Microsoft intends this route for your own people, and app owns data for external users (Power BI embedded analytics).
Sharing with external users as B2B guests
You invite the partner as a guest into your Microsoft Entra ID, and they open the report in the Power BI service. The guest's home company manages their account, so when they leave it and the account is deleted, they lose access to your reports immediately.
Whoever shares needs a Pro or PPU license. The guest needs a Pro or PPU license, their own or one assigned by you, and if the content sits on an F64 or larger capacity, a Free license is enough. Sharing with external users has to be allowed both in the Microsoft Entra ID settings and in the Fabric tenant settings (sharing with guests through Entra B2B).
Power BI Embedded and app owns data
Power BI Embedded puts a report into a web app that you run. The customer signs in to your app, not to Power BI, and needs no Power BI license. Microsoft calls this route embed for your customers, and the documentation calls it app owns data.
- The customer signs in to your app with the app's own sign-in.
- Acting as a service principal, the app asks the Power BI REST API for an embed token for the report.
- If the model uses row-level security, the app writes the customer's identity (effective identity) into the token, and that identity selects the customer's rows.
- The Power BI JavaScript library renders the report in the app's page.
The service principal needs no Pro license. But the report has to sit on a capacity. Without a capacity you can only use free trial tokens for development: the service principal can create a limited number of them, and the report carries a Free trial version banner (moving to production).
The example reports on our website run the same way. Visitors don't sign in anywhere, an Azure Function issues the embed token for the report through a service principal, and the reports sit on an F2 capacity. You can click through them in our Power BI report examples.
Capacities for embedding: A, EM and F
Embedding in your own app means buying a capacity. Microsoft offers three families (capacities and SKUs for embedded analytics):
Capacities for Power BI Embedded
| Capacity | Where you buy it | Billing and commitment | What for |
|---|---|---|---|
| A1 to A8 | Azure, the Power BI Embedded offering | by the hour, no commitment, can be scaled and paused | embedding in apps, doesn't support Fabric items |
| EM1 to EM3 | Microsoft 365 | monthly, with an annual commitment | embedding in apps and Microsoft apps, without access to the Power BI service |
| F2 and up | Azure, Microsoft Fabric | by the hour, or with a reservation | embedding in apps plus all of Fabric |
An F8 capacity matches EM1 and A1 in performance, and F64 matches P1 and A4. How Fabric capacities are billed is covered in the Microsoft Fabric pricing guide.
Power BI Embedded licenses: who needs which?
- Report authors need Pro or PPU to publish to a workspace. Publishing without a license is also possible if a service principal uploads the content through the REST API.
- The service principal the app uses to request tokens needs no Pro license and can't sign in to the Power BI service.
- Customers in your app need no license.
- Your own employees in embedding for your organization need a Power BI license: Pro or PPU on a capacity smaller than F64; on F64 and up, Free is enough.
What the app around it must do
The capacity is only part of the solution. The rest is the app, which someone has to build and maintain:
- Customer sign-in. App owns data leaves sign-in to your app; Power BI doesn't know your customers.
- Issuing tokens. The app holds the service principal's secret or certificate and issues the embed token on the server, never in the browser.
- Refreshing tokens. An embed token has a limited lifetime, and the app must refresh it before it expires (generating an embed token).
- Separating data. One model with row-level security for all customers, or a separate workspace for each customer. Microsoft recommends separation by workspace with service principal profiles (multitenant apps).
FAQ
Does a customer need a Power BI license to see an embedded report?
When you embed in your own app, which Microsoft calls app owns data, the customer needs no license and doesn't sign in to Power BI. Your app signs them in, and the report sits on an A, EM or F capacity.
Can we share a report with external partners as guests?
You can. You invite the partner as a guest into your Microsoft Entra ID, and they open the report in the Power BI service. They need a Pro or PPU license, their own or one assigned by you, unless the content sits on an F64 or larger capacity, where a Free license is enough.
Is Publish to web suitable for customer data?
No. Publish to web makes a report public to anyone on the internet without signing in, including the detailed data in the model, and reports with row-level security can't be published with it. For customers, the routes are a guest in your tenant or embedding in your own app.
Will each customer see only their own data?
Yes, if row-level security is set up in the model and the app writes the customer's identity every time it generates an embed token. The other option, which Microsoft recommends, is a separate workspace for each customer.
Where do you stand?
Data Review
€3,350excl. VAT
We look at your data, your systems and the people the reports should serve. The result is a Data Plan, including which route gets the reports to your customers and partners and what it will cost.
