We have an existing Azure tenant, and would like to open up some PowerBI reports to some external users that are customers. The detail within these reports will contain only customer information.
One idea that we have been tossing around is to invite some customers to our Azure tenant in order to allow this. Our security team has some concerns with this plan. Since a guest user will show up in Azure AD as a user, there is the potential that these external guest users could accidentally be added to other Azure resources incorrectly, therefore gaining access to these other areas. Example: A guest user could accidentally be added to an internal SharePoint site, and have access to internal data of some sort.
I was trying to think of a way to prevent this from occurring, and the best I could come up with is through leveraging "access reviews" (part of Identity Governance). However, my understanding of access reviews is that they are a scheduled item (weekly, monthly, etc), and are therefore an action that would occur after the access has already been granted to the guest user.
Entitlement Management looks like it might have something that could be leveraged to do this, but I am unfamiliar with the details of this Azure function, so I am not sure if it solves the problem or not.
Basically we need some form of secondary authorization, or potentially a blocking mechanism, that only kicks in when an application admin (SharePoint admin for instance) tries to add a guest user, but does not kick in when that same application admin tries to add a normal domain user (person within the company). Does anybody have any ideas on where I could look to find such a solution>