Ways to share Power BI externally
Six options, compared
Six ways to put a Power BI report in front of people outside your organisation.
They differ on three things that matter more than the rest: whether the data stays secure, whether every viewer needs a Power BI licence, and how much work sits between you and going live. The table has the short version; the sections below say when each one is the right call, including when it is not us.
Microsoft's behaviour on this page is taken from its documentation, linked in each section, and was last checked on 18 September 2026.
| Option | Who can see it | Licence per viewer | Security | Sign-in | Effort | Best for |
|---|---|---|---|---|---|---|
| Publish to web | Anyone with the link | None | None | None | Minutes | Public data |
| Guest users (Entra B2B) | Named people you invite | Pro or PPU, or free on F64+ | Full | Microsoft account | Per person | A few long-term collaborators |
| Secure embed | Licensed Power BI users | Pro or PPU, or free on F64+ | Full | Microsoft account | An iframe | Intranets and internal portals |
| Email subscriptions | Any email address | None for recipients | A snapshot, filtered at send time | None | Minutes per schedule | People who want the numbers, not the report |
| Build on Power BI Embedded | Anyone your app lets in | None | Full, but you build it | Whatever you build | Months, then upkeep | Software products |
| A ready-made portal (Embedsy) | Anyone you give a role to | None | Full, built in | Microsoft account, or none | Days | Clients, partners, franchisees, boards |
Each option in detail
Publish to web
The quickest route and the only one with no security at all. Microsoft is explicit that viewing needs no authentication and that the underlying data is reachable even where the report does not display it, so it is unsupported for reports using row-level security and must not be used for confidential data. Your administrator has to switch it on for the tenant, and it embeds whole reports only. Right for a chart on a public website; wrong for anything a customer would not want the world to see.
Microsoft's guidance on Publish to web
See also: Public embed from the Embedsy Portal, for single pages and visuals with live data
Guest users
Each external person is invited into your Microsoft directory as a guest, accepts, and then needs a Power BI licence of their own or one you assign, unless the content sits on a Fabric capacity of F64 or larger. Security is complete and it is Microsoft's recommended way to collaborate with a few outside people. The cost is administrative and grows with every person: invitations, licences, and guest accounts in your directory that stay until someone removes them.
Microsoft's guidance on guest users
See also: Our walkthrough of external sharing in the Power BI service
Secure embed
An iframe you drop into a page you already run, such as SharePoint or an intranet. The viewer signs in with a Microsoft account and their own Power BI permissions apply, which makes it simple and safe. It also means every viewer needs a licence, or your content needs to sit on F64 or larger. In practice that makes it an internal tool: external people rarely have the licence, and giving them one brings you back to the guest-user route.
Email subscriptions
Power BI can email a snapshot of a report, or an exported paginated report, on a schedule. The recipient needs no licence and no account: an email address is enough. External addresses only work when the workspace sits on a paid capacity, not PPU and not a trial; the person creating the subscription needs Pro or PPU; and your administrator has to allow it. What arrives is a picture of the data at send time, and with row-level security you have to make sure each recipient gets the right filtered version. Right for people who want the numbers on Monday morning; wrong for anyone who wants to click into them.
Microsoft's guidance on email subscriptions
See also: Scheduled delivery from the Embedsy Portal, to any address, per recipient
Building on Power BI Embedded
Microsoft's app-owns-data model: your application authenticates with a service principal and viewers need no Power BI licence at all. It is the foundation for every serious external analytics product. It is also only a foundation. Authentication, tenant isolation, row-level security per request, a branded interface, user administration and capacity management all have to be built around it and then maintained as Power BI changes. The right choice when analytics is your product and you have the engineers to own it.
Microsoft's overview of embedded analytics
See also: Build or buy: what building involves, and when it is the right call
A ready-made portal
The same app-owns-data foundation, with the layer around it already built: sign-in, roles, page access, row-level security, branding, scheduling and administration. Viewers need no licence and no Microsoft account unless you want them to use one. What you give up is the freedom to build the interface exactly your way, which is why software companies with product-specific needs often still build. For an organisation whose job is not software, the difference is going live in days rather than months.
Four questions that usually settle it
Answer them in order. Most people arrive at one option within a minute.
- 1
Is the data confidential?
Yes
Next question ↓
No
→ Publish to web
If yes, Publish to web is out, whatever else is true. Everything below keeps your security intact.
- 2
Do they need to click into the report, or just receive the numbers?
They need to interact
Next question ↓
Just the numbers
→ Email subscriptions
A scheduled snapshot is cheap and needs nothing from the recipient. It stops being enough the moment someone wants to filter.
- 3
A handful of people, who have or can be given Power BI licences?
Yes
→ Guest users, or secure embed in a portal you already run
No
Next question ↓
Five collaborators who stay for years suit guest users. Two hundred client users across thirty organisations, with people joining and leaving, need access to be a setting rather than a directory task.
- 4
Is analytics your product, with engineers to own it?
Yes
→ Build on Power BI Embedded
No
→ A ready-made portal
If analytics is the product, building gives you the most control. If you provide it to clients, partners or members as part of a wider relationship, a portal gets you there without a software project.
Where Embedsy sits
Embedsy is the last row: a ready-made portal on Microsoft's app-owns-data model. It is the right answer when you share analytics with people outside your organisation as part of what you do, rather than as the software product you sell, and when the list of those people is long enough that inviting each one as a guest has stopped being reasonable.
It is not the right answer for a public chart, for which Publish to web is free and fine, nor for a software company that wants to own every pixel of its analytics experience. The portal deploys into your own Azure subscription, so your capacity is billed by Microsoft and your data stays where it is. The case for building instead is made in full on the build-versus-buy page.
Common questions
Can I share a Power BI report with someone who has no Power BI licence?
Yes, in four ways. Publish to web makes the report public to anyone, with no security. Email subscriptions send a scheduled snapshot to any address, as long as the workspace is on a paid capacity. Guest users and secure embed let unlicensed viewers in only if the content sits on a Fabric capacity of F64 or larger. The two embedded routes, building on Power BI Embedded or using a ready-made portal, need no licence per viewer at any capacity size, because your application or portal authenticates on the viewer's behalf.
Is Publish to web safe for customer data?
No. Microsoft's own guidance states that anyone on the internet can view a published report without authentication, and that the underlying data in the model is reachable even where the report does not display it. It is unsupported for reports that use row-level security. Use it only for data you would be comfortable putting on a public web page.
What is the difference between app-owns-data and user-owns-data?
In user-owns-data, also called embed for your organisation, each viewer signs in with their own Microsoft account and needs their own Power BI licence. In app-owns-data, also called embed for your customers, your application authenticates with a service principal and viewers need no Power BI licence and no Microsoft account. App-owns-data is the model for external audiences; both building on Power BI Embedded and a ready-made portal use it.
Do I still need a capacity with a ready-made portal?
Yes. Both embedded routes run on a Fabric capacity that you pay Microsoft for directly. A ready-made portal replaces the software you would otherwise build around that capacity, not the capacity itself. The capacity is usually the largest line in the budget, so sizing it and pausing it when idle matters more than the portal fee.
Further reading
Not sure which row you are?
Tell us who needs to see what, and we will say which option fits, including when it is one of the other five.
Prefer a live walkthrough? Book a free demo