Embedding Microsoft Fabric for External Users: A Holiday Special

aferencz21
Dec 3, 2025
3 min read

You’ve built a dazzling dashboard in Microsoft Fabric, and now external users are lining up like kids waiting for Santa. The question: how do you share the goodies without giving away the keys to the sleigh?

Two Flavors of Holiday Cheer

1. Embed for Organization (UserOwnsData)

Think of this as the office Secret Santa. Internal users bring their own badge (Microsoft Entra ID) and unwrap reports directly. Perfect for colleagues, not customers.

2. Embed for Customers (AppOwnsData)

This is the VIP Christmas party pass. Your app plays Santa authenticates with a Service Principal, and hands out embed tokens like candy canes. External users enjoy the view without needing Power BI accounts, no chimney climbing required.

External Data Sharing: The Gift Exchange

Cross-tenant sharing is like sending a holiday card to your neighbor. Fabric admins enable external sharing, you send an invite link, and the recipient creates a shortcut in their lakehouse. No need for Entra B2B guest accounts. Works for tables, files, warehouses, and mirrored databases. Just don’t accidentally share your family pie recipe.

Licensing: No Naughty List Here

Internal users don’t need individual Power BI Pro licenses when using AppOwnsData (with specific Fabric SKUs). Fabric capacity SKUs like F64 and above handle performance scaling. It’s like booking a bigger venue when everyone RSVPs “yes” to the holiday party.

Important Limitation

External users cannot directly access reports hosted in your internal tenant because these reports use UserOwnsData authentication, which requires a Power BI account within your organization’s Microsoft Entra ID. External users do not have these accounts, so they cannot authenticate or view internal workspace content.

Best Practices: Avoid Mixing Gifts

Don’t mix AppOwnsData embedding with External Data Sharing, they serve different purposes. Embedding is for interactive report consumption, while external sharing is for raw data exchange.

Quick Implementation Guide: AppOwnsData Embedding & Token Generation

Step 1: Register an App in Microsoft Entra ID

Go to Azure Portal → App Registrations.
Create a new app and note the Client ID and Tenant ID.
Generate a Client Secret (store it securely).

Step 2: Assign Power BI API Permissions

Under API Permissions, add Power BI Service → Application permissions.
Grant Tenant.Read.All and Report.Read.All.
Click Grant admin consent.

Step 3: Configure Service Principal in Power BI

In Power BI Admin Portal, enable Service Principal access.
Assign the app to a workspace with the reports you want to embed.

Step 4: Generate Embed Token

Use the Power BI REST API or SDK (.NET, JavaScript).
Authenticate with the Service Principal using Client ID, Client Secret, and Tenant ID.
Call GenerateToken for the report or dashboard.
Set token expiration and permissions (view, export, etc.).

Step 5: Embed in Your App

Use the Power BI JavaScript SDK to embed the report in your web app.
Pass the embed token, report ID, and workspace ID.
Add holiday cheer with custom themes and visuals.

Embedding with Fabric for external users is all about balance: security, scalability, and simplicity. Do it right, and customers will think you’re Santa. Do it wrong, and you might accidentally share the company karaoke playlist from last year’s holiday party.

References: