Administering Power BI - frequently asked questions (FAQ)

• Using PowerShell
• How do users sign up for Power BI?
• How do individual users in my organization sign up?
• How can I prevent users from joining my existing organization?
• How can I allow users to join my existing organization?
• How do I check if I have the block on in the tenant?
• How can I prevent my existing users from starting to use Power BI?
• How can I allow my existing users to sign up for Power BI?

• How will this change the way I manage identities for users in my organization today?
• How do we manage Power BI?
• What is the process to manage a tenant created by Microsoft for my users?
• If I have multiple domains, can I control the Microsoft 365 tenant that users get added to?
• How do I remove Power BI for users that already signed up?
• How do I know when new users have joined my tenant?
• Are there any additional things I should prepare for?
• Where is my Power BI tenant located?
• What is the Power BI SLA (Service Level Agreement)?
• How does Power BI handle high availability and failover?

• Does Power BI meet national, regional, and industry-specific compliance requirements?
• How does security work in Power BI?

Some of the procedures in this section require Windows PowerShell scripts. If you're not familiar with PowerShell, we recommend the PowerShell getting started guide. To run the scripts, first install the latest 64-bit version of the Azure Active Directory PowerShell for Graph.

As a Microsoft 365 admin, you can sign up for Power BI through the Power BI web site or the Purchase services page on the Microsoft 365 admin center. When a Microsoft 365 admin signs up for Power BI, they can assign user licenses to users who should have access.

Additionally, individual users in your organization may be able to sign up for Power BI through the Power BI web site. When a user in your organization signs up for Power BI, the service automatically assigns a Power BI license to the user. For more info, see Signing up for Power BI as an individual and Power BI licensing in your organization.

There are three scenarios that might apply to users in your organization:

• Scenario 1: Your organization already has an existing Microsoft 365 environment, and the user signing up for Power BI already has a Microsoft 365 account. In this scenario, if a user already has a work or school account in the tenant (for example, contoso.com) but doesn't yet have Power BI, Microsoft simply activates the Power BI (free) plan for that account. The user is automatically notified with info on how to use the Power BI service.

• Scenario 2: Your organization has an existing Microsoft 365 environment, but the user signing up for Power BI doesn’t have a Microsoft 365 account. In this scenario, the user has an email address in your organization’s domain (for example, contoso.com) but doesn't yet have a Microsoft 365 account. In this case, the user can sign up for Power BI and is automatically given an account. This action lets the user access the Power BI service. For example, if an employee named Nancy uses their work email address (like nancy@contoso.com) to sign up, Microsoft automatically adds Nancy as a user in Contoso’s Microsoft 365 environment and activates Power BI for that account.

• Scenario 3: Your organization doesn't have a Microsoft 365 environment connected to your email domain. There are no administrative actions required for your organization to take advantage of Power BI. The service adds users to a new, cloud-only user directory. You can also choose to take over as the Microsoft 365 Global admin for the tenant and manage them.

There are steps you can take, as a global admin, to prevent users from joining your existing Microsoft 365 tenant. If you block access, users’ attempts to sign up fail, and a message appears that directs them to contact their organization’s admin. You don't need to repeat this process if you have already disabled automatic license distribution (for example, through Office 365 for Education for Students, Faculty, and Staff).

Use the following PowerShell script to prevent new users from joining a managed tenant. (Learn more about PowerShell.)

$msolcred = get-credential
connect-msolservice -credential $msolcred

Set-MsolCompanySettings -AllowEmailVerifiedUsers $false

Use the following PowerShell script to let new users join a managed tenant. (Learn more about PowerShell.)

$msolcred = get-credential
connect-msolservice -credential $msolcred

Set-MsolCompanySettings -AllowEmailVerifiedUsers $true

Use the following PowerShell script to check settings. AllowEmailVerifiedUsers should be false. (Learn more about PowerShell.)

$msolcred = get-credential
connect-msolservice -credential $msolcred

Get-MsolCompanyInformation | fl allow*

The Azure AD setting that controls this is AllowAdHocSubscriptions. Most tenants have this set to true, which means it's enabled. If you acquired Power BI through a partner, this may be set to false, which means it's disabled.

Use the following PowerShell script to disable ad hoc subscriptions.(Learn more about PowerShell.)

1. Sign into Azure Active Directory using your Microsoft 365 credentials. The first line of the following PowerShell script prompts you for your credentials. The second line connects to Azure Active Directory.

    $msolcred = get-credential
    connect-msolservice -credential $msolcred
   

   

2. Once you sign in, run the following command to see how your tenant is currently set up.

    Get-MsolCompanyInformation | fl AllowAdHocSubscriptions
   

3. Run the following command to enable ($true) or disable ($false) AllowAdHocSubscriptions.

    Set-MsolCompanySettings -AllowAdHocSubscriptions $false
   

To allow your existing users to sign up for Power BI, run the command listed for the previous question, but pass $true instead of $false in the last step.

There are three scenarios that might apply to users in your organization:

• Scenario 1: If your organization already has an existing Microsoft 365 environment and all users in your organization have Microsoft 365 accounts, there's no change in how you manage identities.

• Scenario 2: If your organization already has an existing Microsoft 365 environment but not all users in your organization have Microsoft 365 accounts, we create a user in the tenant and assign licenses based on the user’s work or school email address.

  As a result, the number of users you're managing at any particular time grows as users in your organization sign up for the service.

• Scenario 3: If your organization doesn't have a Microsoft 365 environment connected to your email domain, there's no change in how you manage identities.

  The service adds users to a new, cloud-only user directory which you can choose to take over as the Microsoft 365 Global admin and manage them.

Power BI provides a Power BI admin portal for users in the Microsoft 365 Global Admin role and users in the Power BI Service admin role. To use the Power BI admin portal, you must mark your account as a Global Admin within Microsoft 365 or Azure Active Directory, or someone must assign the Power BI service admin role to your user account. For more info, see Understanding the Power BI admin role and Power BI Admin Portal. The portal provides the ability to control tenant-wide settings, view Power BI usage statistics and a link to the Microsoft 365 admin center to manage users and groups.

When a self-service user signs up for a cloud service that uses Azure AD, the service adds them to an unmanaged Azure AD directory based on their email domain. You can claim and manage a tenant that someone created using a process known as admin takeover. For more info, see Take over an unmanaged directory as administrator in Azure Active Directory. The type of takeover you do depends on whether there's an existing managed tenant associated with your domain:

• Power BI supports internal admin takeover. When you perform an internal admin takeover of an unmanaged Azure directory, you are added as the global administrator of the unmanaged directory. No users, domains, or service plans are migrated to any other directory you administer.

• Power BI no longer supports external admin takeover. When you perform an external admin takeover of an unmanaged Azure directory, you add the DNS domain name of the unmanaged directory to your managed Azure directory. External takeover will result in a loss of access to all Power BI content on the original unmanaged tenant. Power BI reports will need to be republished to the new tenant and Power BI dashboards and apps will need to be recreated in the new tenant.

If you do nothing, the service creates a tenant for each user email domain and subdomain. If you want all users to be in the same tenant regardless of their email address extensions: Create a target tenant ahead of time, or use an existing tenant. Then add all the existing domains and subdomains that you want consolidated within that tenant. Every user with email addresses ending in those domains and subdomains automatically join the target tenant when they sign up.

If a user is signed up for Power BI, but you no longer want them to have access to Power BI, you can remove the Power BI license for that user.

1. Go to the Microsoft 365 admin center.

2. In the nav pane, select Users > Active Users.

3. Find the user you want to remove the license for, then select their name.

   You can perform bulk license management to users as well. To do that, select multiple users and select Edit product licenses.

4. On the user details page, next to Product licenses, select Edit.

5. Depending on what license you applied to their account, set Power BI (free) or Power BI Pro to Off.

6. Select Save.

Users who have joined your tenant via self-service sign-up get assigned a unique license that you can filter on within your active user pane in the admin dashboard. To create this new view, follow these steps.

1. Navigate to the Microsoft 365 admin center.

2. In the nav pane, select Users > Active Users.

3. On the Views menu, select Add custom view.

4. Name your new view, and under Assigned product license, select Power BI (free) or Power BI Pro.

   You can only have one license selected per view. If you have both Power BI (free) and Power BI Pro licenses in your organization, you can create two views.

5. Enter any other conditions you want, then select Add.

6. After you create the new view, it's available from the Views menu.

You might experience an increase in password reset requests. For info about this process, see Reset a user's password.

You can remove a user from your tenant via the standard process in the Microsoft 365 admin center. However, if the user still has an active email address from your organization, they can rejoin unless you block all users from joining.

For info about which data region your Power BI tenant is in, see Where is my Power BI tenant located?.

For info about the Power BI SLA (Service Level Agreement), see the Licensing Terms and Documentation article in the Licensing section of the Microsoft Licensing website.

For info about high availability and failover, see Power BI high availability, failover, and disaster recovery FAQ.

To learn more about Power BI compliance, see the Microsoft Trust Center.

Microsoft built Power BI on the foundation of Microsoft 365, which in turn builds on Azure services like Azure Active Directory. For an overview of Power BI architecture, see Power BI Security.

Next steps

• Power BI admin portal
• Understanding the Power BI admin role
• Self-service sign up for Power BI
• Purchasing Power BI Pro
• What is Power BI Premium?
• How to buy Power BI Premium
• Power BI Premium whitepaper
• Manage your group in Power BI and Microsoft 365
• Work or school account management
• Microsoft 365 group management

More questions? Try asking the Power BI Community