M365 PlaybooksPurview · SharePoint · Teams · Exchange· Deploy · Power BI and Fabric
Label Power BI and Fabric content
Purpose
Reports and dashboards often hold the most concentrated sensitive data in the organization: salaries, forecasts, client lists, all in one place. Labelling Power BI and Fabric content tells everyone how carefully a report must be handled, and protects the data when it leaves the service as an Excel, PowerPoint or PDF export. It extends the same labels people use in documents to the place where data is most often summarized and shared.
Overview
The same sensitivity labels applied to Power BI and Fabric items, inherited downstream and protecting data when it is exported.
- Effort
- About 8 to 12 person-days
- Duration
- 4 to 6 weeks
- Complexity
- Medium
- Who's in the room
- Fabric administrator, Purview admin, Power BI centre of excellence or report owners, taxonomy owner
- Licensing
- Applying and viewing labels in Power BI is included in Microsoft 365 E3, E5 and Business Premium. Users also need Power BI Pro or Premium Per User; Power BI is included only with Microsoft 365 E5, and must be licensed separately with other plans.
Risk of not doing it
Sensitive reports carry no indication of how to handle them, and exports to Excel, PowerPoint and PDF leave the service with no protection at all.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Know what labels do in Power BI
Inside the Power BI service, a label doesn't change who can open an item; workspace and item permissions still decide that. The label's protection, such as encryption, is applied when data leaves the service through a supported export: Excel, PDF, PowerPoint (exported as an image), Analyze in Excel, live-connected PivotTables, and download to .pbix. Exports to .csv aren't protected. In Power BI Desktop, an encrypting label on a .pbix file does control who can open it. Make sure report owners understand this split.
Check which labels Power BI can use
Power BI doesn't support labels with Do Not Forward, user-defined permissions or Hold Your Own Key, and exporting from an item labelled with a parent label fails. Check the approved taxonomy against these limits before publishing labels to Power BI users. Information protection in Power BI also doesn't support B2B and multi-tenant scenarios. If your taxonomy uses parent labels with sublabels, publish only the sublabels to Power BI users, so nobody can pick a label that breaks exports.
Confirm licences and who creates content
People applying labels need a Power BI Pro or Premium Per User licence and a Purview information protection licence, plus create and edit permissions on the item. Users with a free licence can't open protected .pbix files. Identify the people who build and publish reports; they are the audience for this rollout. Most report consumers only view content in the service, so the rollout can focus on the smaller group who build and publish.
Decisions
Decision: Who can apply labels?
Labelling is turned on in the Fabric admin portal tenant settings and can be allowed for the entire organization or for specific security groups, with an exceptions group. Starting with a group of report builders keeps the pilot contained. Labels still need to be published to those people in a Purview label policy. Name an owner for the tenant setting, usually the Fabric administrator, and agree that widening it goes through the same review as a label policy change, so the people who can label and the labels they see stay in step.
Options
- The entire organization from day one
- A group of report builders, widened in waves
Recommended default: A group of report builders, widened in waves
Decision: Default and mandatory labels for Power BI?
Label policies can set a default label for Power BI content, independent of the defaults for files and email, and require people to label their Fabric and Power BI content (mandatory labelling currently applies to Power BI items only). Neither applies to B2B users, service principals or APIs. A default label means every new report is labelled from the start.
Options
- No default, labelling optional
- A default label, labelling optional
- A default label, and labelling required
Recommended default: A default label, and labelling required
Decision: How should labels flow between items?
New reports and dashboards inherit the label of the semantic model or report they are built from. Downstream inheritance, on by default when information protection is enabled, passes a label to dependent items, but stops entirely if more than 80 downstream items are affected. Labels can also be inherited from some data sources in Import mode, if that tenant setting is on. Decide which of these to rely on and tell report builders.
Options
- Turn inheritance off and label by hand
- Keep downstream inheritance, and turn on inheritance from data sources where supported
Recommended default: Keep downstream inheritance, and turn on inheritance from data sources where supported
Pilot configuration
Turn on labels for the pilot group
Enable labelling for the pilot security group, publish the Power BI-safe labels to them, and ask them to label their most-used reports and semantic models first, so inheritance carries labels to what is built on them. Pick pilot builders who own widely used semantic models, because a label on a model reaches every new report built on it. Ask them to write down any report they weren't sure how to label; those cases become examples in the guidance.
Test exports and sharing
Export labelled reports to Excel, PowerPoint and PDF and confirm the label and its protection travel with the file. Open a protected .pbix in Desktop as someone with and without access. Check that .csv exports and embedding scenarios behave as you expect, and note the PDF export from Desktop is a preview feature. Include the export paths people actually use: if finance analysts live in Analyze in Excel, test that first. Record any path that doesn't carry protection so the guidance can name it plainly.
Production configuration
Widen and set defaults
Extend labelling to all report builders, then publish the default and mandatory settings so every new item is labelled. Announce the change to everyone who publishes content a week ahead, with the guidance for report builders and a contact for questions. Once defaults and mandatory labelling are on, watch for builders choosing the lowest label by habit; the coverage view and the audit log show where labels look out of line with the workspace's content.
Monitor coverage
Label activity in Power BI is recorded in the audit log and the Power BI activity log, and the Govern report in the OneLake catalog shows label coverage, including the share of unlabelled items. Admins can also set or remove labels in bulk through admin APIs. Review coverage with the Maintain stage. Look first at workspaces known to hold sensitive data, such as finance and HR, and at items with no label at all. Unlabelled items in those workspaces are the gap that matters most. Share what you find with workspace owners, with a short list of items to label.
Make it enforceable
A default label and mandatory labelling make every new Power BI item carry a label, inheritance passes it to what is built from it, and exports through supported paths carry the label's protection. Exports to .csv, B2B scenarios and service principals fall outside it.
Partly enforced. The gaps are a risk until a mechanism covers them.
Pilot to production
Rollout approachBy workload · Pilot size: 10 to 30 report builders
Power BI has its own admin settings, licences and export paths. Treating it as its own workload, with report builders as the pilot, keeps the changes contained and the testing focused.
Make your pilot representative
- Every major role, not only IT and enthusiasts
- More than one location or time zone
- Heavy users of the workload you are changing
- People who handle sensitive information
- At least one team you expect to be sceptical
Brief report buildersChange: Inform
Explain what labels do in the service and on export, and which labels to use. Use a 20-minute session with real reports from the pilot builders' own workspaces, and leave time for questions about exports.
Move on when: Builders know what changes and why
Label key semantic models and reportsChange: Explain
The pilot labels the items others build on. Start with the models most reports depend on, so inheritance does most of the work.
Move on when: Key items are labelled and inheritance works
Test exportsChange: Explain
Confirm protection on Excel, PowerPoint and PDF exports. Cover Excel, PowerPoint and PDF exports, Analyze in Excel, and opening a downloaded .pbix as someone without access.
Move on when: Exports carry the label as expected
Extend and turn on defaultsChange: Explain
Widen the tenant setting and publish default and mandatory settings. Widen the tenant setting group by group, then publish default and mandatory labelling once most builders have used labels at least once.
Move on when: New items are labelled without builders choosing
Review coverage regularlyChange: Sustain
Add the OneLake catalog coverage view to the Maintain review. Look at unlabelled items in sensitive workspaces first, and follow up with their owners rather than labelling for them.
Move on when: Coverage is tracked and unlabelled items are followed up
Common challenges
If youExpect a label to restrict who can open a report
What tends to happenPeople assume a Highly Confidential report is locked down, but access is still decided by workspace permissions.
A better approachExplain that labels protect exports and mark sensitivity; manage access through permissions.
If youPublish every label to Power BI
What tends to happenExports fail on parent labels, and labels with user-defined permissions don't work.
A better approachPublish only the labels Power BI supports.
If youRely on downstream inheritance for large models
What tends to happenModels with more than 80 dependent items pass their label to none of them.
A better approachLabel large models' dependent items directly, or in bulk with the admin APIs.
If youForget .csv exports
What tends to happenSensitive data leaves through the one export path labels don't protect.
A better approachCover .csv exports with guidance and, where possible, with export settings and DLP.
If youTreat Power BI as an afterthought to file labelling
What tends to happenReports summarizing the most sensitive data stay unlabelled long after documents are covered.
A better approachPlan Power BI as its own workload with its own pilot, once file labels are stable.
If youShare labelled content with guest users and expect protection
What tends to happenInformation protection in Power BI doesn't support B2B, so guests see content without the label's controls on export.
A better approachReview which workspaces guests use and cover them with permissions and guidance instead.
Checkpoints
Pilot
- Do report builders understand what labels do inside and outside the service?
- Are only Power BI-safe labels published to the pilot?
- Do exports to Excel, PowerPoint and PDF carry the label?
Production
- Can every report builder apply labels?
- Are the default and mandatory settings for Power BI published?
- Is label coverage reviewed with the Maintain stage?
- Does the guidance for report builders name the export paths that labels don't protect?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Power BI and Fabric items with a label | OneLake catalog Govern report | Up |
| Unlabelled items in workspaces with sensitive data | OneLake catalog Govern report | Down |
| Label changes on Power BI items | Audit log or Power BI activity log | Steady |
Ready-to-use text
Guidance for report builders
Label every report and semantic model you publish. The label tells colleagues how carefully to handle it and protects the data when someone exports it to Excel, PowerPoint or PDF. It doesn't change who can open the report in Power BI: workspace permissions do that. New reports take the label of the model they're built on. Exports to .csv are not protected, so avoid them for sensitive data.
Pilot builder checklist
1. Label your most-used semantic models first. 2. Check new reports built on them inherited the label. 3. Export a report to Excel, PowerPoint and PDF and confirm the label travelled with it. 4. Note any report you weren't sure how to label, and why. 5. Tell us about any export path you use that we haven't tested.
Additional reading
Configure
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |