Skip to main content

User Types

Administrator

DataCentral supports five distinct user identity types. The type of user determines how they authenticate, how they are managed, and how they consume Power BI licenses.

1. Azure AD (Internal)​

These are users who exist within your organization's primary Microsoft Entra ID (Azure AD) tenant.

  • Authentication: They log in using their standard Microsoft 365 credentials.
  • Licensing: When viewing a report, they use their own personal Power BI Pro or Premium Per User (PPU) license. If the workspace is on a dedicated Power BI Premium capacity (P SKU or F SKU), a Pro or Premium Per User (PPU) license is not required.
  • Management: These users can be managed individually in DataCentral, or their membership can be automatically synchronized using Microsoft Graph Sync.

2. External Azure AD (Guest)​

These are users who belong to a different organization's Entra ID tenant and access your environment through B2B guest collaboration.

  • Authentication: They log in using their home organization's Microsoft credentials.
  • Licensing: Like internal users, they typically bring their own Power BI Pro license (BYOL) or rely on the Azure/Fabric capacity you assigned to the specific workspace from which you are sharing reports from.
  • Management: If DataCentral is configured with a Microsoft Graph Service Principal that has the required permissions, DataCentral can invite these users automatically when they are added. Otherwise, they must be invited as Guests in Entra ID before they can be added.
  • Note: There is no separate login option for external Entra ID users. Both internal and external Entra ID users select the same Microsoft / Entra ID login method on the DataCentral login screen.

3. User Pass​

User Pass accounts are local credentials managed entirely within DataCentral. They do not exist in Microsoft Entra ID.

  • Authentication: They log in using a username and password created by a DataCentral Tenant Administrator.
  • Licensing: Because they do not have Microsoft identities, they cannot use personal Power BI licenses. Instead, DataCentral uses a Power BI Service Principal to generate an embed token for them. This is known as "App Owns Data" embedding or "License Pooling."
  • Use Case: Ideal for sharing data with external clients, partners, or contractors who do not use Microsoft 365, or when you want to absorb the licensing cost on their behalf.

4. Mobile ID​

Mobile ID users authenticate using an electronic identification service on their mobile device rather than a password. Like User Pass accounts, they are managed within DataCentral and do not require an Entra ID account.

  • Authentication: Users enter their mobile number on the login screen and complete authentication through the connected electronic identification flow on their mobile device.
  • Licensing: Mobile ID users rely on a Power BI Service Principal to access reports, identical to User Pass accounts.
  • Use Case: Ideal for users who already rely on electronic ID services and need secure access without a traditional username and password.

5. One-time Password​

One-time Password (OTP) users are managed within DataCentral and authenticate using a time-limited verification code instead of a permanent password.

  • Authentication: Users enter their email address on the login screen and complete sign-in with a one-time verification code sent to that address.
  • Licensing: OTP users rely on a Power BI Service Principal to access reports, similar to User Pass and Mobile ID accounts.
  • Use Case: Ideal for external users, occasional users, or short-term access scenarios where you want a simpler experience than managing passwords.

Summary Comparison​

User TypeAuthenticationIdentity SourcePower BI Licensing
Azure ADMicrosoft 365Your Entra IDUser's Pro License (or Premium Capacity)
External Azure ADMicrosoft 365Guest's Entra IDUser's Pro License (or Premium Capacity)
User PassUsername/PasswordDataCentralService Principal (License Pooling)
Mobile IDElectronic IdentificationDataCentralService Principal (License Pooling)
One-time PasswordEmail Verification CodeDataCentralService Principal (License Pooling)

Next Steps​

Now that you understand the different user types, learn how to Create and Manage Users and assign them to Organizational Units.