Power BI User Management Guide

• Model type: hybrid
• Description: Power BI uses a two-tier permission model. At the tenant level, administrative roles (Fabric Administrator, Global Administrator) are assigned via Microsoft Entra ID and control tenant-wide settings via the Admin portal. At the workspace level, a fixed set of four roles (Admin, Member, Contributor, Viewer) controls access to content within each workspace. There are no custom roles at either level. Row-level security (RLS) can be defined within datasets to restrict data access for specific users or groups, adding a data-layer permission dimension.
• Custom roles: No
• Custom roles plan: Not documented
• Granularity: Tenant-level: binary admin/non-admin via Entra ID roles. Workspace-level: four fixed roles (Admin, Member, Contributor, Viewer). Dataset-level: Row-Level Security (RLS) roles defined in Power BI Desktop or the service, assigned to users or Entra ID groups. Object-level security (OLS) available for column/table hiding within datasets.

1. Navigate to the Microsoft 365 Admin Center (https://admin.microsoft.com) to create the user account if it does not already exist in Entra ID.
2. Assign a Power BI license (Free, Pro, or PPU) to the user: in Microsoft 365 Admin Center, go to Users → Active Users → select the user → Licenses and apps → check the appropriate Power BI license → Save changes.
3. Alternatively, assign licenses in bulk via Entra ID group-based licensing: Azure Portal → Microsoft Entra ID → Groups → select group → Licenses → assign Power BI license to the group.
4. To add a user to a specific Power BI workspace: open Power BI Service (app.powerbi.com) → navigate to the target workspace → click the three-dot menu or 'Manage access' → 'Add people or groups' → enter the user's email or Entra ID group name → select the workspace role (Admin, Member, Contributor, or Viewer) → click Add.
5. To grant tenant-level admin rights: in Microsoft Entra ID admin center (entra.microsoft.com) → Roles and administrators → search for 'Fabric Administrator' → Assignments → Add assignment → select the user.

Required fields: User's Microsoft Entra ID account (UPN / email address), Power BI license type (Free, Pro, or PPU), Workspace role (Admin, Member, Contributor, or Viewer) if adding to a workspace

Watch out for:

• Users must have a Microsoft Entra ID account in the organization's tenant before they can be assigned a Power BI license or added to a workspace. External (guest) users require B2B collaboration setup in Entra ID.
• License assignment is done in Microsoft 365 Admin Center or Entra ID - not within the Power BI Admin portal itself. The Power BI Admin portal shows users but does not have a native 'assign license' button.
• Self-service sign-up allows users to acquire a free Power BI license on their own using a work email. Admins can disable this in Microsoft 365 Admin Center under Org settings → Services → Power BI, but it is enabled by default.
• Guest (external) users can be added to workspaces but require the 'Allow Azure Active Directory guest users to access Power BI' tenant setting to be enabled in the Power BI Admin portal.
• Adding a user to a workspace does not automatically assign them a Power BI license - both steps are required independently.
• Group-based workspace access is recommended over individual user assignment for easier management at scale.

• Can delete users: Verify in tenant
• Delete/deactivate behavior: This app exposes delete operations in its API documentation, but the admin-console path may present removal as deactivation, archiving, or deletion depending on tenant configuration. Confirm whether the UI action is reversible before treating removal as recoverable.

1. To revoke Power BI access without deleting the account: go to Microsoft 365 Admin Center (admin.microsoft.com) → Users → Active Users → select the user → Licenses and apps → uncheck the Power BI license (Pro or PPU) → Save changes. The user loses access to Power BI Service immediately.
2. To remove the user from specific workspaces: in Power BI Service (app.powerbi.com) → navigate to the workspace → Manage access → find the user → click the three-dot menu next to their name → Remove.
3. To fully disable the account: in Microsoft 365 Admin Center → Users → Active Users → select the user → Block sign-in → confirm. This prevents all Microsoft 365 service access including Power BI.
4. To permanently delete the account: in Microsoft 365 Admin Center → Users → Deleted users (after blocking sign-in and deleting the account) → the account enters a 30-day soft-delete period before permanent deletion.

Watch out for:

• Datasets owned by a deleted user will have their scheduled refreshes fail. Admins should take over dataset ownership before removing the user: in Power BI Service, navigate to the dataset settings → Data source credentials → take over, or use the Power BI REST API to reassign ownership.
• Deleting a user in Microsoft 365 does not immediately remove their content from Power BI workspaces - shared workspace content persists. My Workspace content becomes inaccessible but is not immediately purged.
• Power BI admins can access a deleted user's My Workspace content for a limited period via the Admin portal (Admin portal → Workspaces → filter for the user's personal workspace) to recover or reassign content.
• If the user was the only Admin of a shared workspace, the workspace will have no admin after removal. Another Global Admin or Fabric Admin must reassign workspace admin rights before removing the user.
• License removal does not remove the user from workspace membership lists - they remain listed but cannot access the service. Explicit removal from workspaces is a separate step.
• Guest (B2B) users must be removed from both the Power BI workspace and the Entra ID B2B guest account to fully revoke access.

• Where to check usage: Power BI Admin portal (app.powerbi.com/admin-portal) → Users - shows all licensed users and their license types. Microsoft 365 Admin Center (admin.microsoft.com) → Billing → Licenses - shows total purchased vs. assigned seats per license SKU. Microsoft 365 Admin Center → Reports → Usage → Power BI - shows active user counts and activity.
• How to identify unused seats: In Microsoft 365 Admin Center, go to Reports → Usage → Power BI to see last-activity dates per user. Users with no activity in the past 30/90 days can be identified for license review. The Power BI Admin portal's Usage Metrics and the Microsoft 365 Usage Analytics report (requires enabling in Admin portal) provide per-user activity data. Admins can also use the Power BI Activity Log (via REST API or Admin portal → Audit logs) to identify inactive licensed users.
• Billing notes: Power BI Pro and PPU licenses are purchased and managed through Microsoft 365 Admin Center (Billing → Purchase services) or via Microsoft volume licensing agreements (EA, MCA). Fabric capacity is purchased via the Azure portal as a Fabric capacity resource. Price increase effective April 1, 2025: Pro from $10 to $14/user/month (+40%), PPU from $20 to $24/user/month (+20%). Microsoft 365 E5 and Office 365 E5 subscribers retain Power BI Pro at no additional cost with no price change. P-SKUs (P1–P5) were retired in January 2025; customers are being migrated to equivalent Fabric F-SKUs. Trial licenses (Power BI Pro 60-day trial) can be self-service activated by users unless disabled by the admin in Microsoft 365 Admin Center → Org settings → Services → Power BI.

Adding one user correctly requires: creating or confirming their Entra ID account, assigning the right license tier (Free, Pro, or PPU) in Microsoft 365 Admin Center, and then separately adding them to each relevant workspace with the correct role (Admin, Member, Contributor, or Viewer).

These are independent steps with no automatic linkage - adding someone to a workspace does not assign a license, and assigning a license does not grant workspace access.

Offboarding carries its own risk surface. Removing a user's license or disabling their Entra ID account does not remove them from workspace membership lists. Dataset ownership must be manually reassigned before removal, or scheduled refreshes will silently fail.

If the departing user was the sole Workspace Admin, the workspace loses its admin entirely - there is no automated warning or transfer prompt.

The April 2025 price increase - Pro up 40% to $14/user/month, PPU up 20% to $24/user/month - drew sustained criticism, particularly from organizations with large Pro user bases.

Microsoft 365 E5 and Office 365 E5 subscribers are unaffected, but standalone Power BI customers absorbed the full increase.

The P-SKU retirement in January 2025 added procurement friction: Fabric capacity (F-SKUs) is now billed through Azure rather than Microsoft 365, splitting billing across two procurement channels for organizations that manage them separately.

The licensing interaction between Free, Pro, PPU, and Fabric capacity remains a persistent source of confusion - specifically, which combination is required to share content with a given user type.

Workspace admin assignment is manual and per-workspace. There is no bulk mechanism to assign or audit workspace roles across multiple workspaces simultaneously, which creates operational drag at scale.

Common complaints:

• No direct SCIM support for non-Microsoft IdPs (Okta, Google Workspace, OneLogin); all automated provisioning must route through Microsoft Entra ID, requiring Entra ID P1/P2 licensing.
• Licensing model complexity: the interaction between Free, Pro, PPU, and Fabric capacity SKUs creates confusion about which license combination is required for sharing content with specific user types.
• The April 2025 price increase (Pro +40%, PPU +20%) was widely criticized in the community as significant, particularly for organizations with large numbers of Pro users.
• P-SKU retirement in January 2025 forced organizations to migrate to Fabric F-SKUs, which are billed through Azure rather than Microsoft 365, creating billing and procurement complexity for organizations that manage Microsoft 365 and Azure separately.
• Workspace admin assignment is manual and per-workspace; there is no tenant-level mechanism to bulk-assign workspace roles across multiple workspaces simultaneously.
• Scheduled refresh failures after user removal are a common operational pain point - dataset ownership must be manually reassigned before removing a user, and there is no automated warning or transfer workflow.
• Self-service license sign-up is enabled by default, leading to uncontrolled license sprawl if not proactively disabled by admins.
• PPU content isolation (PPU users can only share with other PPU users) is seen as a significant limitation that forces organizations to either purchase capacity SKUs or require all users to have PPU licenses.
• The Power BI Admin portal does not allow direct license assignment - admins must switch between the Power BI Admin portal and Microsoft 365 Admin Center to manage users, which is considered a fragmented experience.
• Guest user (B2B) access configuration requires coordination across Power BI tenant settings and Entra ID B2B settings, which is considered overly complex for simple external sharing scenarios.

Every app that sits inside the Microsoft 365 ecosystem will reflect the same two-tier permission architecture Power BI uses: tenant-level admin rights (Fabric Administrator, Global Administrator) assigned via Entra ID, and resource-level access controlled by fixed roles.

In Power BI, workspace roles are Admin, Member, Contributor, and Viewer - no custom roles exist at either tier. Row-Level Security (RLS) and Object-Level Security (OLS) add a data-layer dimension within datasets, defined separately in Power BI Desktop or the service.

The PPU licensing cliff is a practical decision point: PPU workspace content can only be shared with other PPU-licensed users. Sharing broadly requires either a Fabric capacity SKU (workspace-level, billed via Azure) or downgrading to Pro, which loses Premium features. Teams should map their sharing patterns to license tiers before provisioning at scale.

Bottom line

Power BI user management works, but it is deliberately distributed across Microsoft 365 Admin Center, Entra ID, and the Power BI Service - and each surface handles a different part of the problem.

Every app in a mature Microsoft 365 environment will inherit this architecture, so the operational cost scales with the number of workspaces and license tiers in play.

The April 2025 price increases and P-SKU retirement have reset cost assumptions for many organizations; anyone budgeting for Power BI access management should verify current license counts and billing channels before projecting costs forward.