Question

 How do I integrate sensitivity labels with Power BI’s sharing and publishing features?
I’m looking to understand how sensitivity labels can be integrated into Power BI’s workflow, especially when sharing reports or publishing them to Power BI Service or external platforms. What is the correct way to ensure that labels remain intact and enforce data protection throughout the sharing and publishing process?

Answer 1

To align sensitivity labels with Power BI's sharing and publishing capabilities, you must set up Microsoft Purview Information Protection sensitivity labels and make Power BI capable of supporting them. These labels can be added to reports, dashboards, datasets, and dataflows within Power BI Desktop or the Power BI Service. Once added, the label metadata accompanies the file or artifact, even when shared or published, assisting in having consistent data protection.

When publishing reports to the Power BI Service, the sensitivity label is still applied, and based on the configuration of the label (e.g., encryption, access limitations), it can limit how users can interact with the report. For instance, certain labels can prevent data from being exported or require user authentication. Likewise, when sharing reports with external users, the labels assist in enforcing compliance by restricting actions like downloading, copying, or resharing content.

To keep labels intact and in effect:

• Activate Microsoft Purview Information Protection for Power BI in the Microsoft 365 compliance center.
• Set up labels with encryption and content marking, if necessary.
• Turn on mandatory labeling policies if your organization requires it.
• Inform users about label inheritance, since datasets can inherit a label from the source file, such as Excel or SQL.