Preventing External Sharing in Power BI

Quick Answer

Disabling 'Share content with external users' in the Power BI admin portal is one of the three necessary actions because it's the setting that most directly governs whether users can share workspace content with people outside the organization at all, making it the most direct lever for this requirement. But it works alongside two other controls that close off different paths to the same outcome: creating a Microsoft Entra ID conditional access policy blocks external users from reaching Power BI resources at the identity and access layer, independent of any in-app sharing setting, while disabling 'Publish to web' shuts down a separate mechanism that would otherwise let a report become publicly embeddable and viewable by anyone with a link, external users included, regardless of the sharing setting. Each of these three addresses a different route external users could otherwise use to see content, which is why all three are needed together rather than any single one being sufficient on its own. The two remaining options don't actually touch external sharing: disabling the creation of app workspaces only prevents new workspaces from being made, and disabling 'Export to Excel' only affects data export, neither of which controls whether existing content can be shared with or accessed by people outside the tenant. When a requirement is about fully preventing a category of access, expect the answer to require closing multiple independent paths rather than a single setting.