Microsoft recently consolidated and renamed its B2B guest access controls across Microsoft Fabric, replacing the older “Allow external guest users to edit and manage content” toggle with a new set of Fabric-wide tenant settings. The legacy setting now maps to updated switches under Export and sharing tenant settings, including “Guest users can access Microsoft Fabric” and “Users can invite guest users to collaborate.”
For organizations that work with vendors, this change matters. Settings that worked before may need reconfiguring, and admins unfamiliar with the new layout may accidentally lock out their vendors with no clear reason given.
This guide covers the full setup process for onboarding vendors as external guest users in Power BI, using the current Fabric B2B controls, from enabling the right tenant settings to assigning workspace, connection, and gateway access.
Key Takeaways Use external users for secure onboarding: Onboarding vendors as guest users through Microsoft Entra B2B is the safest and most scalable way to provide access without creating internal accounts. Tenant settings must be enabled first: Admins must configure guest access and external sharing settings in the Power BI Admin Portal before any external user can access content. Access goes beyond workspaces: Vendors need access to workspaces, connections, and gateways to fully work with data and build reports. No credential sharing is required: Admins can share connections securely, letting vendors use data sources without exposing sensitive login details.Permissions control everything: Role-based access (Viewer, Contributor, Admin) defines what vendors can view, create, or manage within Power BI.
What Is Vendor Onboarding in Power BI? Vendor Onboarding in Power BI refers to the process of giving external users (vendors, partners, or consultants) access to your Power BI or Microsoft Fabric environment so they can collaborate on reports, datasets, and analytics workflows. Instead of limiting access to internal employees, organizations can securely allow external users to work within their tenants.
In many real-world scenarios, companies rely on vendors for development, data integration , or analytics support. Providing them with access becomes essential, but sharing internal credentials is not a safe or scalable option. This is where vendor onboarding using external users becomes the preferred approach.
Why Vendor Onboarding in Power BI Is Important Enables external collaboration: Organizations often work with vendors for report development, data engineering, or support. Vendor onboarding allows them to work directly within the Power BI environment. Avoids sharing internal credentials: Instead of creating internal accounts or sharing logins, external users can securely access the system using their own identity. Support scalable access management: External users can be added, managed, and removed without affecting internal users, making it easier to control access. Improve security and governance: Admins can add, manage, and remove external users without affecting internal users, making access control simpler.Aligns with modern collaboration practices: Using external user access (via Microsoft Entra B2B) is now a standard approach for working with third-party teams.
Why Use External Users Instead of Internal Accounts? Creating internal accounts for vendors might seem simpler, but it creates more problems than it solves. You end up managing extra credentials, dealing with offboarding risks, and creating accounts that exist outside your normal identity lifecycle.
External user access through Microsoft Entra B2B is the standard approach for a reason.
No internal account creation required: Vendors use their own email and identity. You are not adding them to your HR or IT systems — just your directory as guests. Authentication through Microsoft Entra: Every login goes through Entra, so access is governed by your enterprise security policies from day one. Centralized access management: All guest user permissions live in one place. Granting, modifying, or revoking access takes minutes. Works natively with Power BI and Fabric: Once onboarded, external users interact with workspaces, reports, and datasets the same way internal users do — just within the limits of whatever role you assign. Controlled collaboration: You define exactly what each vendor can access. Nothing is open by default.
How Vendor Onboarding Works with External Users Benefit Explanation Secure collaboration with external users Microsoft Entra B2B allows organizations to share Power BI resources with vendors while maintaining strict security controls and authentication policies. No need for internal account creation External users can access your environment using their own credentials, removing the need to create and manage internal user accounts. Centralized access control and governance All permissions and access are managed from a single place, making it easier for admins to monitor, update, or revoke access when needed. Scalable onboarding for multiple vendors Organizations can onboard multiple vendors efficiently without increasing administrative overhead or complexity.
This approach ensures that vendor onboarding is both secure and scalable, making it suitable for organizations working with multiple external partners.
Prerequisites for Vendor Onboarding in Power BI Before starting Vendor Onboarding in Power BI, it is important to ensure that the required roles, permissions, and configurations are in place. Since onboarding external users involves both identity management and Power BI access control, the process typically requires multiple administrators.
Having the right setup ensures that the onboarding process is smooth, secure, and properly governed from the beginning.
Key Roles Required for Vendor Onboarding in Power BI Azure (Microsoft Entra) Admin: Responsible for creating and managing external (guest) users in the organization’s directory. This role handles sending invitations, validating user identities, and ensuring vendors are correctly added to the tenant before granting any access.Power BI / Microsoft Fabric Admin: Responsible for configuring tenant-level settings in Power BI or Fabric. This includes enabling guest access, controlling external sharing, and defining how external users can interact with workspaces, reports, and data.
Why both roles matter: User creation and access configuration are intentionally separate. This prevents a single point of failure and ensures the process grants access in a controlled, auditable way.
Key Prerequisites Checklist External user invitation permissions enabled in Microsoft Entra Guest access settings enabled in Power BI / Fabric External sharing settings configured Required admin roles assigned Clear understanding of access levels (Viewer, Contributor, Admin)
Below are the steps to onboard a vendor into Power BI.
Step 1: Enable Guest Access in Tenant Settings This is where most failed onboarding attempts start. Even if a vendor is invited and has accepted, they cannot access anything until the right tenant settings are enabled.
How to Enable These Settings Go to Power BI Service (app.powerbi.com) Navigate to Settings → Admin Portal Search for: Enable the required options at:
Settings to enable: Setting Purpose Guest users can access Microsoft Fabric The core setting. Allows external users to access Power BI and Fabric items based on their assigned permissions Allow users to invite guest users Lets internal users invite vendors through standard sharing options Guest users can browse and access content Allows external users to explore available content within the tenant Guest users appear in people picker Makes external users searchable when assigning workspace roles or sharing content
You can enable these at the organization level or limit them to specific security groups depending on your governance requirements.
Step 2: Invite the Vendor as a Guest User With tenant settings in place, the next step is inviting the vendor into your directory through Microsoft Entra.
Steps to Invite External Users
Go to Azure Portal: Open portal.azure.com and sign in with an account that has admin permissions. Navigate to Users section : Search for Users or go to: Azure Active Directory → Users
Create a new guest user New User → Invite External User to open the invitation form. Enter user details Send the invitation Invite . The system will send an email invitation to the external user.
What happens after the invitation is sent: The vendor receives an email with a link to join your organization. Once invited, they appear in your Microsoft Entra directory as a guest user. At this stage, they are in your directory — but they have no access to any Power BI content yet. That is configured in the steps below.
This is an important distinction. Being added to the directory and having access to workspaces or data are two separate things. Both need to be done.
Step 3: Configure the Power BI Admin Portal Even after inviting the vendor, Power BI-specific settings need to be confirmed in the Admin Portal. Without these, external users cannot use the platform properly even if Entra has them set up correctly.
How to Access Power BI Admin Portal
Go to Power BI Service (app.powerbi.com) Click on Settings (gear icon) Use the search bar to find relevant settings:
Configure Guest Settings for Vendor Onboarding in Power BI Guest settings play a key role in Vendor Onboarding in Power BI, as they control how external (guest) users can access and interact with your Power BI and Microsoft Fabric environment. These settings ensure that once a vendor is invited, they can browse content, collaborate, and work within your tenant based on the permissions assigned.
Properly configuring these settings is essential to enable collaboration while still maintaining control over what external users can and cannot do.
Key Guest Settings to Enable Guest users can access Microsoft Fabric: This is the most important setting. It allows external users added to your directory to access Fabric items such as reports, datasets, and workspaces. Users can invite guest users to collaborate: Enables internal users to invite external users directly while sharing content, improving collaboration. Guest users can browse and access content: Allows external users to explore available content within the tenant based on their permissions. Guest users appear in people picker: Ensures that external users can be searched and selected when assigning workspace roles or sharing content.
Step 4: Vendor Accepts the Invitation This step happens on the vendor’s side and must be completed before they can access anything.
Vendor opens the invitation email from your organization Clicks the Accept Invitation link Signs in using their own credentials Accepts the required permissions to join your tenant
After completing this, the vendor is confirmed as a guest in your directory. The invitation state changes from pending to active, and you can now assign them access to workspaces, connections, and gateways.
Step 5: Switch to the Host Tenant After accepting the invitation, vendors default to landing in their own tenant when they log into Power BI. To access your shared content, they need to switch to your organization’s tenant.
This step catches a lot of first-time external users off guard. Worth covering explicitly in any onboarding documentation you send them.
Steps to Switch Tenant in Power BI
Log in to Power BI Service app.powerbi.com and sign in using the external user (vendor) account that received the invitation. Open the profile menu profile icon . This opens the account panel where tenant details are shown. Click on “Switch tenant” “Switch tenant” option. This will display a list of all organizations (tenants) you have access to. Select the host organization Switch and load the environment
All shared workspaces, reports, and datasets are only visible after this switch. If a vendor says they cannot see anything, this is usually the first thing to check.
Step 6: Create and Assign Workspace Access With the vendor in the right tenant, you can now give them access to the workspace where they will actually work.
Workspaces are where reports, datasets, and other Power BI content are created and managed. Giving vendors access to the right workspace is essential for effective collaboration.
Steps to Create and Assign Workspace Access
Create a new workspace Workspaces → New Workspace and create a workspace for testing or collaboration. Configure workspace details Open workspace access settings Manage Access to control who can use it. Add an external user to the workspace Assign appropriate role
How to Validate Workspace Access
Log in as the external (vendor) user app.powerbi.com using the vendor’s account that was invited. Make sure you are using the correct external login. Switch to the correct tenant Switch tenant → select the host organization. Without this, you won’t see any shared content. Refresh the Power BI page Check the Workspaces section Workspaces . You should now see the workspace that was shared with the external user. Open the assigned workspace Verify role-based access
Step 7: Share Data Connection Access Workspace access gets vendors into the environment — but they also need access to data connections to actually build anything. Without this, they cannot connect to data sources, build pipelines, or refresh reports that rely on external data.
Power BI lets you share connections without handing over credentials. The vendor gets access to use the connection; they never see the underlying login details.
Steps to Provide Connection Access
Go to Manage Connections and Gateways Settings → Manage connections and gateways . Create a new connection (if not available)
This can be done even without creating a data pipeline or dataflow.
Open connection settings three dots (… icon) next to the connection and select Manage users . Add external user Assign appropriate permission level Click Share Share to grant access.
Step 8: Assign Gateway Access for Vendor Onboarding in Power BI If your solution involves data sources hosted on-premise, the vendor also needs access to the on-premise gateway. Without it, they cannot refresh data or create new connections that run through the gateway, even if they have workspace and connection access.
Steps to Assign Gateway Access Go to Manage Connections and Gateways Settings → Manage connections and gateways . Open Data Gateways tab Data gateways section to view available gateways. Check gateway status online and running before assigning access. Open gateway user management three dots (… icon) next to the gateway and select Manage users . Add external user Assign appropriate roles Click Share
Final Setup for Vendor Onboarding in Power BI At this stage, Vendor Onboarding in Power BI is almost complete. All the major components—user access, workspace permissions, connections, and gateway access—have been configured. Now it’s important to ensure everything works together smoothly so that the vendor can start working without any issues.
This final step focuses on verifying the complete setup and ensuring that the external user has the right level of access across all required areas.
Final Checklist for Vendor Onboarding in Power BI External user successfully added: Invite the vendor through Microsoft Entra and confirm they’ve accepted the invitation. They should now appear in your directory as a guest and be searchable when assigning access. Tenant settings properly configured: Enable all required guest and external sharing settings in the Power BI Admin Portal. Without these, the external user won’t be able to access or interact with content. Workspace access assigned: Add the vendor to the correct workspace and assign the appropriate role. Match the access level (Viewer, Contributor, or Admin) to the work they need to do. Connection access provided: Share the required data connections with the external user. This lets them use data sources without needing direct access to credentials.Gateway access configured (if required): If the solution uses on-premise data, make sure the vendor has access to the gateway. Without this, they won’t be able to refresh data or create new connections.
What the Vendor Can Do Now Access shared workspaces: The vendor can open and navigate through assigned workspaces after switching to the correct tenant. View and build reports: Based on their role, they can either view reports or actively create and modify them. Use datasets and connections: The vendor can connect to existing datasets and use shared connections to build new reports or pipelines. Create new content (based on role): If given Contributor or Admin access, they can create reports, dashboards, and other items within the workspace. Collaborate with internal teams: Vendors can now work alongside internal users, share updates, and contribute to ongoing analytics work.
Common Issues to Check Workspace not visible: The user likely hasn’t switched to the correct tenant or hasn’t been added to the workspace. Check both before troubleshooting further. Access denied errors: Check permissions at every level: workspace, connection, and gateway. A gap at any one level will block access. Connection not available: Workspace access alone isn’t enough. You need to explicitly share the connection with the external user. Gateway issues: Confirm the gateway is online and that you’ve assigned the user the required role (such as connection creator). Without this, data refresh and connection creation will fail.
Partner with Kanerika to Modernize Your Enterprise Operations with High-Impact Data & AI Solutions Call or Text Us Now
Limitations of Vendor Onboarding in Power BI While this feature enables secure collaboration with external users, there are certain limitations that organizations should be aware of. Understanding these helps in planning access properly and avoiding issues during implementation.
Common Limitations to Consider Requires coordination between multiple admins: The onboarding process involves both Microsoft Entra (Azure) Admin and Power BI Admin. Lack of coordination can delay setup or cause misconfiguration. Configure all required settings : Set up guest access, external sharing, workspace permissions, connections, and gateway access correctly. Missing any one of these can break the onboarding flow. Grant access after setup : Even after users accept the invite, they cannot access anything until you explicitly assign workspace, connection, and gateway permissions. Guide users on tenant switching : External users must switch to the correct tenant to access content, which can confuse first-time users. Manage security carefully : External access can expose data if you do not configure permissions properly. Set up additional features if needed : Features like email subscriptions, semantic model sharing, and advanced data sharing may require extra setup or may not be enabled by default.
Microsoft Fabric vs Power BI: How They Differ and Which One You Need An in-depth comparison of Microsoft Fabric and Power BI, explaining their differences, use cases, and how to choose the right solution for your data and analytics needs.
Learn More
Kanerika: Elevating Your Reporting and Analytics with Expert Data Solutions At Kanerika, we help businesses move beyond basic reporting by delivering smart, scalable analytics powered by Power BI and Microsoft Fabric. As a Microsoft-certified Data and AI Solutions Partner , we specialize in turning complex data into clear, actionable insights that help organizations make faster and better-informed decisions.
We tailor our solutions to each client’s needs, combining data visualization, predictive analytics, and intelligent automation using Power BI and Microsoft Fabric . Whether the industry is manufacturing, finance, healthcare, or retail, we design analytics ecosystems that surface hidden patterns, improve performance, and support strategic growth.
With deep expertise in Microsoft’s analytics stack, including Power BI and Microsoft Fabric, our team builds interactive dashboards, streamlines data flows, and develops enterprise-grade data strategies that align with your business goals. Moreover, our skilled analysts and data scientists help organizations improve operations, reduce inefficiencies, and stay ahead of the competition with data they can trust.
FAQs What is a vendor onboarding process? A vendor onboarding process is a structured workflow that brings external partners into your business systems with appropriate access, documentation, and compliance checks. In Power BI environments, this involves configuring Azure AD guest access, assigning workspace permissions, and establishing data sharing protocols. Effective vendor onboarding in Power BI ensures partners can collaborate on dashboards and reports while maintaining data security. The process typically includes identity verification, access provisioning, and training on organizational standards. Kanerika streamlines vendor onboarding workflows with automation and governance best practices—contact us to simplify your external collaboration strategy.
What is the safest way to give vendors access to Power BI? The safest way to give vendors access to Power BI is through Azure AD B2B guest accounts combined with row-level security. This approach authenticates external users without creating internal accounts while restricting data visibility to only what each vendor needs. Configure workspace roles at the Viewer level unless editing is explicitly required, and enable sensitivity labels to protect confidential reports. Avoid sharing entire datasets when filtered views suffice. Implementing conditional access policies adds another protection layer for external Power BI access. Kanerika designs secure vendor access frameworks tailored to your compliance requirements—schedule a consultation today.
What tenant settings need to be enabled before onboarding a vendor? Before onboarding a vendor in Power BI, enable several critical tenant settings in the Admin Portal. First, activate external sharing under Export and Sharing settings to permit guest access. Enable Azure AD B2B integration to allow guest user invitations. Configure the Allow Azure Active Directory guest users to access Power BI setting for your security groups. Review cross-tenant access policies to permit collaboration with specific partner domains. Disable broad sharing options that could expose sensitive content beyond intended recipients. Kanerika’s Power BI governance specialists ensure your tenant configuration balances collaboration with security—reach out for a tenant audit.
What permissions should I assign to a vendor? Assign vendors the minimum permissions required for their specific tasks in Power BI. Most external partners need only Viewer access to consume reports without modifying content. Use the Contributor role when vendors must publish or edit reports within designated workspaces. Avoid Admin or Member roles for external users as these grant excessive control over workspace settings and membership. Implement row-level security to filter data visibility based on vendor identity, ensuring partners see only relevant information. Always document permission assignments for compliance audits. Kanerika helps organizations define role-based access frameworks for vendor collaboration—connect with our team for guidance.
Do vendors need a Microsoft account to be onboarded? Vendors do not necessarily need an existing Microsoft account to be onboarded to Power BI. Azure AD B2B collaboration supports multiple authentication options including email one-time passcodes for users without Microsoft or organizational accounts. Partners with existing Microsoft 365 or Azure AD accounts can authenticate directly. Google federation allows vendors using Gmail to sign in seamlessly. However, having a Microsoft account streamlines the experience and reduces authentication friction. Configure your tenant to accept the identity providers your vendors commonly use. Kanerika configures flexible identity federation for seamless vendor onboarding experiences—let us optimize your external access setup.
Why can't my vendor see the workspace after accepting the invitation? A vendor cannot see the workspace after accepting an invitation typically due to incomplete permission propagation or tenant configuration issues. Verify the guest user was explicitly added to the workspace with an appropriate role assignment. Check that Azure AD B2B settings allow guest users to access Power BI in your tenant admin portal. Confirm the vendor accepted the invitation using the correct email address matching their guest account. License requirements may also block access if guest licensing policies are misconfigured. Allow up to 24 hours for permissions to fully propagate across services. Kanerika troubleshoots vendor access issues quickly—contact us to resolve your onboarding challenges.
Can vendors access data sources without seeing the credentials? Vendors can access data sources without seeing credentials when you configure Power BI datasets properly. Use the gateway with stored credentials so data connections authenticate automatically without exposing passwords to report consumers. Service principals provide another secure method for automated authentication invisible to end users. Dataset owners maintain credential control while viewers interact with refreshed data seamlessly. Row-level security further restricts which data records vendors can access regardless of underlying connection details. Never embed credentials in queries or connection strings visible to external users. Kanerika implements secure data connectivity patterns for vendor collaboration—discuss your data access requirements with our specialists.
Is gateway access always required? Gateway access is not always required for vendor onboarding in Power BI. Cloud-based data sources like Azure SQL Database, Dataverse, or SharePoint Online connect directly without an on-premises gateway. The gateway becomes necessary when datasets pull from on-premises sources such as SQL Server, Oracle databases, or file shares behind your firewall. For vendor scenarios, pre-built datasets that refresh through your gateway allow external users to view reports without direct gateway configuration. Evaluate your data architecture to determine connectivity requirements before onboarding external partners. Kanerika assesses your data infrastructure to design optimal vendor access paths—schedule a discovery session with our team.
What are the risks of supplier onboarding? Supplier onboarding risks include data exposure, security breaches, compliance violations, and operational disruptions. Overly permissive Power BI workspace access can leak sensitive business intelligence to unauthorized parties. Inadequate identity verification during vendor onboarding may grant access to malicious actors impersonating legitimate partners. Compliance risks emerge when external sharing violates industry regulations like GDPR or HIPAA. Integration failures can disrupt analytics workflows and delay decision-making. Poor offboarding practices leave orphaned accounts vulnerable to exploitation after vendor relationships end. Implementing governance controls and access reviews mitigates these supplier onboarding risks effectively. Kanerika builds risk-managed vendor onboarding frameworks—partner with us to protect your data assets.
What are the documents required for vendor onboarding? Documents required for vendor onboarding typically include business registration certificates, tax identification numbers, banking details for payments, insurance certificates, and signed contracts or NDAs. For Power BI access specifically, document the vendor’s authorized user list, data access requirements, confidentiality agreements covering shared analytics, and acceptable use policies. Compliance-driven organizations may require security questionnaires, SOC 2 attestations, or GDPR data processing agreements. Maintain documentation of granted permissions and access scope for audit purposes. Standard templates accelerate the vendor onboarding documentation process while ensuring consistency. Kanerika develops comprehensive vendor onboarding documentation frameworks—reach out to standardize your external partner workflows.
Does Microsoft have a vendor management system? Microsoft does not offer a dedicated standalone vendor management system but provides tools that support vendor management workflows. Azure AD handles external identity management through B2B collaboration for guest access. Microsoft 365 admin center manages external user permissions across services including Power BI. Dynamics 365 Supply Chain Management includes vendor collaboration portals for procurement processes. Power Platform enables custom vendor management applications with Power Apps and automated workflows through Power Automate. These components integrate to create comprehensive vendor lifecycle management when properly configured. Kanerika builds unified vendor management solutions on Microsoft technologies—explore how we can consolidate your partner operations.
What are the four stages of vendor management? The four stages of vendor management are selection, onboarding, performance monitoring, and offboarding. Selection involves evaluating potential vendors against criteria like capabilities, pricing, and compliance standards. Onboarding establishes system access, documentation, and relationship governance including Power BI workspace provisioning. Performance monitoring tracks vendor deliverables, SLA adherence, and collaboration effectiveness through dashboards and regular reviews. Offboarding revokes access, archives documentation, and ensures knowledge transfer when relationships conclude. Each stage requires defined processes and accountability to manage vendor relationships effectively throughout their lifecycle. Kanerika implements end-to-end vendor management processes with Power BI analytics—let us optimize your vendor lifecycle operations.
Which is the platform most widely used for vendor onboarding? SAP Ariba, Coupa, and Oracle Procurement Cloud are among the most widely used platforms for vendor onboarding in enterprise environments. However, Microsoft Power Platform combined with Azure AD increasingly handles vendor onboarding for organizations invested in the Microsoft ecosystem. Power BI specifically enables analytics-focused vendor collaboration with robust security controls and seamless Microsoft 365 integration. The best platform depends on your existing technology stack, procurement complexity, and integration requirements. Organizations using Microsoft technologies benefit from unified vendor management across Power BI, Teams, and SharePoint. Kanerika implements vendor onboarding solutions across leading platforms—consult with us to select the right approach for your environment.
What are the three most important elements of successful onboarding? The three most important elements of successful onboarding are clear communication, structured access provisioning, and ongoing support. Clear communication establishes expectations, timelines, and responsibilities before granting system access. Structured access provisioning ensures vendors receive appropriate Power BI permissions without overexposure to sensitive data through proper workspace roles and row-level security. Ongoing support includes training resources, documented processes, and responsive assistance when issues arise. These elements reduce onboarding friction, accelerate time-to-productivity, and establish strong vendor relationships from the start. Neglecting any element leads to confusion, security gaps, or partner dissatisfaction. Kanerika delivers comprehensive vendor onboarding programs combining all three elements—start your onboarding transformation with our experts.
