Choose Metabase when its query builder, SQL workflow, and deployment options fit how your team explores data. Choose Power BI when its reporting and distribution environment fit the organization. Build a narrow reporting portal when customers need a stable set of measures, clear explanations, and a tightly controlled view of their own records.
The most consequential choice is often the access model. A public dashboard, a signed guest embed, and a fully authenticated analytics application are different products. Comparing them as if they were interchangeable can produce both a misleading budget and an unsafe design.
Compare the report contract and access boundary
Official sources were checked September 26, 2026. The custom column is Looski's proposed bounded portal. Product facts below do not replace testing the permissions of your deployed configuration.
| Criterion | Metabase | Power BI | Build your own |
|---|---|---|---|
| Self-service questions | Query builder supports staged filtering, summarizing, and joining. Builder | Report authoring and consumption use the Power BI model and tooling. Plans | Offer named measures and allowed filters, not arbitrary queries by default. |
| Deployment | Open Source, hosted, and paid self-hosted offerings differ. Pricing | User and capacity-based service choices affect distribution. Pricing | Own application deployment, upgrades, and availability. |
| Guest embedding | Signed guest embeds do not create Metabase user sessions. Embed security | Choose the appropriate supported embedding and identity arrangement. Embedded offer | Authenticate users and authorize each report request server-side. |
| Guest isolation | Locked parameters secure guest-embed scope; ordinary user permissions do not apply there. Security | Test the effective viewer identity used by the embedding design. | Never accept tenant identity merely from an editable URL filter. |
| Authenticated embedding | Modular/full-app embedding with SSO is a Pro/Enterprise capability. Security | Distribution and licensing depend on audience/capacity. Sharing | Reuse your product's identity and enforce explicit data scope. |
| Row/column restrictions | Row and column security is available on Pro/Enterprise. Permissions | RLS applies to Viewers, not workspace editing roles. RLS | Apply the same policy to charts, detail, exports, and caches. |
| SQL caveat | Query-builder row/column security does not secure arbitrary native SQL results. Limitations | Validate model security in the actual connection and role configuration. RLS | Restrict query surfaces or enforce security in the database/service. |
| Tenant storage | Documentation distinguishes shared database, database-per-customer, and schema-per-customer designs. Embedding permissions | Map the chosen data layout to the semantic model and access design. | Make tenant partitioning an architectural decision before UI work. |
| Freshness | Scope database load, caching, and report needs in the trial. | Refresh frequency depends on model and capacity. Refresh | Display the last successful data update and incomplete periods. |
| User experience | Retain query exploration when customers actually need it. | Retain interactive reports when the licensed audience needs them. | Explain a small report in the language of the service being purchased. |
Price the right edition and audience
Metabase lists a free Open Source offering and separates hosted and paid capabilities. The existence of a free edition does not mean authenticated embedding or row/column security is free. Microsoft distinguishes free authoring, per-user plans, and variable embedded capacity. Obtain a dated quote for the actual internal and external audience, currency, billing term, support, and deployment. Metabase pricing, Power BI pricing.
Metabase offers its Open Source Edition under AGPL and documents separate embedding and commercial license routes. Its embedding-license option includes retaining the Metabase attribution, while enterprise capabilities require the appropriate commercial license. Wrapping it in your own portal does not erase those terms. Metabase licenses.
For Power BI service sharing, Microsoft says free viewers require eligible capacity: P SKUs or Fabric F64 and above, with both the report and semantic model appropriately hosted. Smaller Fabric capacities do not generally remove the Pro requirement for these shared-content viewers. Customer-facing embedded capacity is a separate design and cost decision. Sharing requirements.
For this comparison, a universal per-seat total would conceal the most important difference: whether customers need a fixed signed report, authenticated exploration, or a custom portal. Decide that scope before multiplying users by a headline price. Retain database and engineering costs in every option.
| Cost or migration item | Required decision | Evidence before commitment |
|---|---|---|
| Audience | Internal staff, external customers, or both | Actual user journeys and distribution rights |
| Interactivity | Fixed reports, drill-through, or self-service exploration | Demonstration with a restricted customer account |
| Data isolation | Shared tables, schemas, or separate databases | Cross-customer denial tests for every access path |
| Migration | Measures, saved questions, filters, and subscriptions | Totals reconciled to source records under the same definitions |
| Hosting | Managed service versus operated infrastructure | Backup, upgrade, restore, and incident responsibilities |
| Custom portal | Query performance, exports, authorization, and support | A complete working report contract rather than a chart prototype |
Choose the smallest useful reporting surface
Our analysis favors Metabase when database-oriented teams want quick exploration and the required edition fits their security model. Favor Power BI when its semantic models, distribution arrangements, and organizational skills are already useful assets. Pilot both against the same customer question instead of comparing unrelated demonstration dashboards.
For a service provider, customers might need request volume, turnaround, open work, and an explanation of exceptions. If those are stable questions, a custom portal can present them directly. It can explain whether paused time is excluded from turnaround and show the records contributing to a total.
Avoid removing exploration that customers genuinely use. Watch several users solve their reporting task before deciding that four fixed charts are enough. A custom portal becomes expensive when every customer asks for a slightly different report and each request needs a deployment.
Security belongs in the report design
Metabase documents an important distinction: guest embeds use signed resources and locked parameters, while authenticated embeds can apply user-aware permissions. A filter shown in the browser is not automatically a security boundary. Select the mechanism intentionally and test its actual behavior. Securing embeds.
Native SQL also needs deliberate treatment. Metabase's row/column security applies to the query builder and cannot be assumed to constrain arbitrary SQL results. If you grant SQL access, use the documented alternatives and database-level controls appropriate to that access. Row and column security limitations.
In a custom portal, derive customer scope from trusted identity. Apply it when querying and exporting, and include it in any cache key. A safe chart paired with an unscoped CSV endpoint is still an unsafe report. Test support impersonation and administrator tools as separate privileged paths.
Give measures a written definition and version. State the reporting timezone, treatment of reopened requests, and meaning of a paused service clock. Keep the transformation independent of the UI so the same logic can support a vendor report and the custom portal during migration.
Pilot two customers, not one happy path
Create two customers with overlapping dates and similar record names. Give each records that should never appear in the other's totals. Attempt access through changed filters, copied links, direct export requests, and cached results after switching accounts.
Reconcile every measure to source records. Include a reopened request, late-arriving update, deleted record, and timezone boundary. Change a customer's permission while a report is open and verify the next request respects the change.
Measure time to answer a customer's question, number of unexplained discrepancies, and the maintenance required for a definition change. Keep the previous reporting route during a controlled transition. Buy exploration and embedding where they solve the problem; build a portal where a small, explicit, permission-aware report contract is the product experience you want to own.
Frequently asked questions
What should customers be able to customize?
Start with filters that support known decisions and keep definitions fixed. Add exploration only when users need it and the data model can support it without misleading results or exposing other customers' records.
What would a first custom reporting portal include?
Define a small report contract with named measures, allowed filters, a freshness timestamp, and explicit customer scoping. Keep authorization on the server for both on-screen results and exports. Provide drill-through to the records that explain a total and make definition changes visible to users.
How should we compare the cost of Metabase, Power BI, and a custom build?
Compare authoring, audience access, hosting, and embedding requirements using current terms. Include query optimization and ongoing authorization testing in the custom option. Compare the same scope and planning horizon, including implementation, retained services, maintenance, and support. A lower subscription bill alone does not establish a lower total cost.