# Label Power BI and Fabric content - URL: https://m365playbooks.com/playbooks/label-power-bi-and-fabric-content/ - Topic: Sensitivity labels (Program) - Product: Purview, SharePoint, Teams, Exchange - Stage: Deploy - Last reviewed: October 15, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Reports and dashboards often hold the most concentrated sensitive data in the organization: salaries, forecasts, client lists, all in one place. Labelling Power BI and Fabric content tells everyone how carefully a report must be handled, and protects the data when it leaves the service as an Excel, PowerPoint or PDF export. It extends the same labels people use in documents to the place where data is most often summarized and shared. ## 2. Overview The same sensitivity labels applied to Power BI and Fabric items, inherited downstream and protecting data when it is exported. - Effort: About 8 to 12 person-days - Duration: 4 to 6 weeks - Complexity: Medium - Who's in the room: Fabric administrator, Purview admin, Power BI centre of excellence or report owners, taxonomy owner - Licensing: Applying and viewing labels in Power BI is included in Microsoft 365 E3, E5 and Business Premium. Users also need Power BI Pro or Premium Per User; Power BI is included only with Microsoft 365 E5, and must be licensed separately with other plans. - Risk of not doing it: Sensitive reports carry no indication of how to handle them, and exports to Excel, PowerPoint and PDF leave the service with no protection at all. ## 3. Key activities ### Prerequisites 1. **Know what labels do in Power BI** Inside the Power BI service, a label doesn't change who can open an item; workspace and item permissions still decide that. The label's protection, such as encryption, is applied when data leaves the service through a supported export: Excel, PDF, PowerPoint (exported as an image), Analyze in Excel, live-connected PivotTables, and download to .pbix. Exports to .csv aren't protected. In Power BI Desktop, an encrypting label on a .pbix file does control who can open it. Make sure report owners understand this split. Who: Taxonomy owner with the Fabric administrator. Produces: A shared understanding written into report owner guidance. 2. **Check which labels Power BI can use** Power BI doesn't support labels with Do Not Forward, user-defined permissions or Hold Your Own Key, and exporting from an item labelled with a parent label fails. Check the approved taxonomy against these limits before publishing labels to Power BI users. Information protection in Power BI also doesn't support B2B and multi-tenant scenarios. If your taxonomy uses parent labels with sublabels, publish only the sublabels to Power BI users, so nobody can pick a label that breaks exports. Who: Purview admin. Produces: A list of labels that are safe to use in Power BI. 3. **Confirm licences and who creates content** People applying labels need a Power BI Pro or Premium Per User licence and a Purview information protection licence, plus create and edit permissions on the item. Users with a free licence can't open protected .pbix files. Identify the people who build and publish reports; they are the audience for this rollout. Most report consumers only view content in the service, so the rollout can focus on the smaller group who build and publish. Who: Fabric administrator. Produces: A list of report builders with the right licences. ### Decisions 4. **Decision: Who can apply labels?** Labelling is turned on in the Fabric admin portal tenant settings and can be allowed for the entire organization or for specific security groups, with an exceptions group. Starting with a group of report builders keeps the pilot contained. Labels still need to be published to those people in a Purview label policy. Name an owner for the tenant setting, usually the Fabric administrator, and agree that widening it goes through the same review as a label policy change, so the people who can label and the labels they see stay in step. Options: The entire organization from day one; A group of report builders, widened in waves. Recommended default: A group of report builders, widened in waves. Who: Fabric administrator. Produces: A security group allowed to apply labels. 5. **Decision: Default and mandatory labels for Power BI?** Label policies can set a default label for Power BI content, independent of the defaults for files and email, and require people to label their Fabric and Power BI content (mandatory labelling currently applies to Power BI items only). Neither applies to B2B users, service principals or APIs. A default label means every new report is labelled from the start. Options: No default, labelling optional; A default label, labelling optional; A default label, and labelling required. Recommended default: A default label, and labelling required. Who: Taxonomy owner. Produces: Power BI settings in the label policy. 6. **Decision: How should labels flow between items?** New reports and dashboards inherit the label of the semantic model or report they are built from. Downstream inheritance, on by default when information protection is enabled, passes a label to dependent items, but stops entirely if more than 80 downstream items are affected. Labels can also be inherited from some data sources in Import mode, if that tenant setting is on. Decide which of these to rely on and tell report builders. Options: Turn inheritance off and label by hand; Keep downstream inheritance, and turn on inheritance from data sources where supported. Recommended default: Keep downstream inheritance, and turn on inheritance from data sources where supported. Who: Fabric administrator with the taxonomy owner. Produces: Agreed inheritance settings. ### Pilot configuration 7. **Turn on labels for the pilot group** Enable labelling for the pilot security group, publish the Power BI-safe labels to them, and ask them to label their most-used reports and semantic models first, so inheritance carries labels to what is built on them. Pick pilot builders who own widely used semantic models, because a label on a model reaches every new report built on it. Ask them to write down any report they weren't sure how to label; those cases become examples in the guidance. Who: Fabric administrator. Produces: Labels live for the pilot group. 8. **Test exports and sharing** Export labelled reports to Excel, PowerPoint and PDF and confirm the label and its protection travel with the file. Open a protected .pbix in Desktop as someone with and without access. Check that .csv exports and embedding scenarios behave as you expect, and note the PDF export from Desktop is a preview feature. Include the export paths people actually use: if finance analysts live in Analyze in Excel, test that first. Record any path that doesn't carry protection so the guidance can name it plainly. Who: Report owners with the Purview admin. Produces: A tested export list and guidance. ### Production configuration 9. **Widen and set defaults** Extend labelling to all report builders, then publish the default and mandatory settings so every new item is labelled. Announce the change to everyone who publishes content a week ahead, with the guidance for report builders and a contact for questions. Once defaults and mandatory labelling are on, watch for builders choosing the lowest label by habit; the coverage view and the audit log show where labels look out of line with the workspace's content. Who: Fabric administrator. Produces: Labelling for all report builders, with defaults on. 10. **Monitor coverage** Label activity in Power BI is recorded in the audit log and the Power BI activity log, and the Govern report in the OneLake catalog shows label coverage, including the share of unlabelled items. Admins can also set or remove labels in bulk through admin APIs. Review coverage with the Maintain stage. Look first at workspaces known to hold sensitive data, such as finance and HR, and at items with no label at all. Unlabelled items in those workspaces are the gap that matters most. Share what you find with workspace owners, with a short list of items to label. Who: Fabric administrator. Produces: Label coverage reviewed with Maintain. 11. **Make it enforceable** A default label and mandatory labelling make every new Power BI item carry a label, inheritance passes it to what is built from it, and exports through supported paths carry the label's protection. Exports to .csv, B2B scenarios and service principals fall outside it. _Partly enforced. The gaps are a risk until a mechanism covers them._ ## 4. Pilot to production **Rollout approach:** By workload (Pilot size: 10 to 30 report builders). Power BI has its own admin settings, licences and export paths. Treating it as its own workload, with report builders as the pilot, keeps the changes contained and the testing focused. 1. **Brief report builders** (Change: Inform) Explain what labels do in the service and on export, and which labels to use. Use a 20-minute session with real reports from the pilot builders' own workspaces, and leave time for questions about exports. Move on when: Builders know what changes and why. 2. **Label key semantic models and reports** (Change: Explain) The pilot labels the items others build on. Start with the models most reports depend on, so inheritance does most of the work. Move on when: Key items are labelled and inheritance works. 3. **Test exports** (Change: Explain) Confirm protection on Excel, PowerPoint and PDF exports. Cover Excel, PowerPoint and PDF exports, Analyze in Excel, and opening a downloaded .pbix as someone without access. Move on when: Exports carry the label as expected. 4. **Extend and turn on defaults** (Change: Explain) Widen the tenant setting and publish default and mandatory settings. Widen the tenant setting group by group, then publish default and mandatory labelling once most builders have used labels at least once. Move on when: New items are labelled without builders choosing. 5. **Review coverage regularly** (Change: Sustain) Add the OneLake catalog coverage view to the Maintain review. Look at unlabelled items in sensitive workspaces first, and follow up with their owners rather than labelling for them. Move on when: Coverage is tracked and unlabelled items are followed up. ## 5. Common challenges - **If you** Expect a label to restrict who can open a report. What tends to happen: People assume a Highly Confidential report is locked down, but access is still decided by workspace permissions.. A better approach: Explain that labels protect exports and mark sensitivity; manage access through permissions. - **If you** Publish every label to Power BI. What tends to happen: Exports fail on parent labels, and labels with user-defined permissions don't work.. A better approach: Publish only the labels Power BI supports. - **If you** Rely on downstream inheritance for large models. What tends to happen: Models with more than 80 dependent items pass their label to none of them.. A better approach: Label large models' dependent items directly, or in bulk with the admin APIs. - **If you** Forget .csv exports. What tends to happen: Sensitive data leaves through the one export path labels don't protect.. A better approach: Cover .csv exports with guidance and, where possible, with export settings and DLP. - **If you** Treat Power BI as an afterthought to file labelling. What tends to happen: Reports summarizing the most sensitive data stay unlabelled long after documents are covered.. A better approach: Plan Power BI as its own workload with its own pilot, once file labels are stable. - **If you** Share labelled content with guest users and expect protection. What tends to happen: Information protection in Power BI doesn't support B2B, so guests see content without the label's controls on export.. A better approach: Review which workspaces guests use and cover them with permissions and guidance instead. ## 6. Checkpoints **Pilot:** - [ ] Do report builders understand what labels do inside and outside the service? - [ ] Are only Power BI-safe labels published to the pilot? - [ ] Do exports to Excel, PowerPoint and PDF carry the label? **Production:** - [ ] Can every report builder apply labels? - [ ] Are the default and mandatory settings for Power BI published? - [ ] Is label coverage reviewed with the Maintain stage? - [ ] Does the guidance for report builders name the export paths that labels don't protect? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Power BI and Fabric items with a label (Where you see it: OneLake catalog Govern report; Good direction: Up) - Unlabelled items in workspaces with sensitive data (Where you see it: OneLake catalog Govern report; Good direction: Down) - Label changes on Power BI items (Where you see it: Audit log or Power BI activity log; Good direction: Steady) **Ready-to-use text: Guidance for report builders** > Label every report and semantic model you publish. The label tells colleagues how carefully to handle it and protects the data when someone exports it to Excel, PowerPoint or PDF. It doesn't change who can open the report in Power BI: workspace permissions do that. New reports take the label of the model they're built on. Exports to .csv are not protected, so avoid them for sensitive data. **Ready-to-use text: Pilot builder checklist** > 1. Label your most-used semantic models first. 2. Check new reports built on them inherited the label. 3. Export a report to Excel, PowerPoint and PDF and confirm the label travelled with it. 4. Note any report you weren't sure how to label, and why. 5. Tell us about any export path you use that we haven't tested. ## 8. Additional reading **Plan:** - [Sensitivity labels in Power BI](https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-security-sensitivity-label-overview) - [Information protection in Fabric](https://learn.microsoft.com/en-us/fabric/governance/information-protection) **Configure:** - [Enable sensitivity labels in Fabric and Power BI](https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-security-enable-data-sensitivity-labels) - [Default label policy in Power BI and Fabric](https://learn.microsoft.com/en-us/fabric/governance/service-security-sensitivity-label-default-label-policy) - [Mandatory label policy in Fabric and Power BI](https://learn.microsoft.com/en-us/fabric/governance/service-security-sensitivity-label-mandatory-label-policy) - [Sensitivity label downstream inheritance in Power BI](https://learn.microsoft.com/en-us/fabric/governance/service-security-sensitivity-label-downstream-inheritance) **Monitor:** - [Sensitivity label audit schema](https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-security-sensitivity-label-audit-schema) - [Govern and manage your Fabric data with the OneLake catalog](https://learn.microsoft.com/en-us/fabric/governance/onelake-catalog-govern) ## Changelog - Version 1, 2026-10-15, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-15.