Can't access workspace From external Orgs "unable to authenticate your credentials"

[RIS_KevinN]

I'm trying to access a workspace shared from a customers Power BI service but getting an error "unable to authenticate your credentials".

Let me begin by saying I am a consultant with a couple of different software companies and work with dozens of individual customers.  I created a Power BI dashboard for one of these customers on my Power BI service but then exported for them to import into the service for their domain.  They have added me as a guest user in their Microsoft Entra ID and at one point I briefly had access to their workspace, which they made me an admin of.

One of the software companies I work with also has me doing their system admin work, which includes maintaining their Azure environment.  Rather than setting me up with an account in their Entra ID they added my business id as an external member of their Entra ID.

When I try to access my customers Power BI workspace it does show up but I get an popup stating We've encounted some s with guest content.  Please try and refresh your browser.  It then shows Error type AAD Authentication Failure and under Organization shows the company I do system admin work for.

When I log into my azure portal and view my account, I do see my business identity as Home organization and below that the two customer organizations mentioned above.  I'm not sure why it is trying to authenticate my account against the one customers organization instead of my own.

[RIS_KevinN · Accepted solution]

Thank you both, again for the replies.  I was able to resolve the issue with portions of both of your recommendations.  Since I have no access to the clients tenant, I was unable to make changes or even validate the specific settings.  What I ended up doing on that front was to have the IT service provider create a new User and give it administrative rights to the Power BI workspace.  They then shared the credentials for that account with me.  

After that user was created I took johnbasha33's suggestion of deploying and configuring the on-premise gateway on their network using the credentials of the new account.  

After following those steps, the model is now refreshing for the end users and me.

[v-jtian-msft]

@RIS_KevinN ,I am glad to help you . @johnbasha33,thank you so much for your help with this issue.
I wanted to share my solution with you.

According to  your description, you are accessing the customer's workspace and the system is showing that it is unable to validate the credentials.

This means that you are an external user to the customer's organization and do not have access to it!
Could you tell me what kind of permissions (administrator or guest user) are granted to you by the client company that owns the workspace where the credential problem is occurring?

Here is a possible solution I can offer you:

1.You can ask the company you are working for to invite you as an internal user of their organization, if you want to go and access the corresponding workspace then you also need to ask an internal member of your client's company to access you to the workspace as viewer so that you can gain access to the internal workspace of their organization.

2. Or you can have your client company use Microsoft Entra B2B

Invite you as a guest user of the organization (you are not a full member at this time)

By sharing specific content in the worksapce that you need to view, you can view it without being an internal member of the organization.

Of course, if you need to have access to the entire workspace, you will need to contact the user's company and ask them to invite you (at this point you have been invited as a guest user) This is the best way to meet your needs!

Here's a case of how a user can be added as a guest within your organization (B2B) and invited to the workspace.

1.login Microsoft 365 admin center(need to be an administrator within your customer's organization to operate) and add guest users.

2. They need to invite you(Join the organization as a guest)

This completes the invitation to you, all you need to do is accept the invitation (sent by email)
3.Access you(guest user) to workspace

This will allow you to access the workspace within your customer's organization.
Please ask your client company to do the above to add you as a guest user to the workspace. If you're having issues after becoming a guest user, try asking them to delete your guest user and add it again.
I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.
Best Regards,
Carson Jian,
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[RIS_KevinN]

My client has given me admin access to the workspace, note the 2nd access shown in the snip below.

For whatever reason it just doesn't let me refresh the data.  I can refresh the data working with the report through Power BI Desktop and then upload the updated report to the workspace but it's not allowing refresh once uploaded.  I'm looking into the options provided by johnbasha33 but when I tried the gateway installer it installed it to my workspaces and not my customers even though I installed it on their server.

I'm also told by other organization users who are contributors to the organizations workspace that they can't refresh the data either, so perhaps it is related to johnbasha33's suggestions.

[v-jtian-msft]

@RIS_KevinN ，
I am glad to help you.
Could it be because an administrator in the organization has this setting turned on in the admin portal:
Block republish and disable package refresh

This setting is located in Tenant Settings in Power BI and can be found in the Administrator Portal.
When this setting is enabled, only the owner of the semantic model will be able to perform the refresh operation and other users will not be able to refresh the data.
When this setting is turned on, it is valid for the entire organization.
I suggest you contact the administrator of your client's organization to see if this option is turned on (to secure the semantic model), if it has nothing to do with this setting, then you can check the gateway settings again as you thought.

I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.

Best Regards,

Carson Jian,

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[johnbasha33]

@RIS_KevinN 

When publishing a Power BI report to the Power BI Service, the data connection can either be through a cloud-based data source or through an on-premises data source using a gateway. Here are the advantages and disadvantages of each:

Cloud Connection:
Advantages:
1. Seamless Integration: Cloud connections offer seamless integration with Power BI Service without the need for additional configurations.
2. Data Security: Data is securely stored and managed within the cloud environment, providing robust security features.
3. Scalability: Cloud-based data sources offer scalability, allowing for easy scaling up or down based on data needs.
4. Automatic Refresh: Cloud-based data sources can be configured for automatic refresh in the Power BI Service, ensuring that the data is always up-to-date.

Disadvantages:
1. Data Privacy Concerns: Some organizations may have data privacy concerns about storing sensitive data in the cloud.
2. Connectivity Requirements: Requires stable internet connectivity for accessing cloud-based data sources.

On-Premises Connection (via Gateway):
Advantages:
1. Data Privacy: On-premises connections offer enhanced data privacy as sensitive data remains within the organization's infrastructure.
2. Connectivity Options: Supports various connectivity options, including DirectQuery and Import mode, providing flexibility in data retrieval.
3. Hybrid Deployment: Allows organizations to maintain control over their data while leveraging the benefits of cloud-based analytics and visualization tools.

Disadvantages:
1. Gateway Configuration: Requires installation and configuration of an on-premises data gateway, which adds complexity to the setup.
2. Network Dependencies: Relies on network connectivity between the Power BI Service and the on-premises data source, which may introduce latency or connectivity issues.
3. Manual Refresh: In some cases, on-premises data sources may require manual refreshes, as opposed to automatic refreshes available for cloud-based data sources.

To enable a cloud connection for your data source, ensure that your data source supports cloud connectivity and that you have the necessary permissions to access it. Generally, cloud databases such as Azure SQL Database, Azure SQL Data Warehouse, and other cloud-based services offer native integration with Power BI Service without the need for an on-premises gateway.

If your data source does not support direct cloud connectivity, or if you prefer to keep your data on-premises for security or compliance reasons, you can continue using the on-premises gateway to establish a secure connection between your Power BI reports and your data source.

Did I answer your question? Mark my post as a solution! Appreciate your Kudos !!