|
| 1 | +Sensitivity labels in Power BI extend your organization's data protection strategy into business intelligence. Reports, dashboards, semantic models, and dataflows often contain the same sensitive data that lives in your documents and emails. Without labels, that data loses its classification the moment someone builds a report from it. Applying sensitivity labels in Power BI keeps the protection consistent from the source data through to the final exported file. |
| 2 | + |
| 3 | +## Requirements for applying labels in Power BI |
| 4 | + |
| 5 | +Before you can apply sensitivity labels in Power BI, several prerequisites must be in place: |
| 6 | + |
| 7 | +- You need a Power BI Pro or Premium Per User (PPU) license, along with Edit permission on the content you want to label. Users with a Free license can only apply labels to items in their own **My workspace**. |
| 8 | +- Sensitivity labels must be enabled for your organization through the Fabric admin portal. The tenant setting **Allow users to apply sensitivity labels for content** controls this capability. |
| 9 | +- You must belong to a security group with permissions to apply sensitivity labels, as configured in the Fabric admin portal under **Information protection**. |
| 10 | +- Your labels and label policies must already be published from the Microsoft Purview portal. |
| 11 | + |
| 12 | +## Apply sensitivity labels in the Power BI service |
| 13 | + |
| 14 | +In the Power BI service, sensitivity labels appear in a **Sensitivity** column in the workspace list view for dashboards, reports, semantic models, and dataflows. This column gives you a quick overview of how content is classified across the workspace. |
| 15 | + |
| 16 | +To apply or change a label on a report or dashboard: |
| 17 | + |
| 18 | +1. Select the **More options (...)** menu for the item, then select **Settings**. |
| 19 | +1. In the **Settings** side pane, go to the **Sensitivity label** section. |
| 20 | +1. Select the appropriate sensitivity label from the list. |
| 21 | + |
| 22 | +The process is similar for semantic models and dataflows. Open **Settings** for the item, expand the **Sensitivity label** section, and select the label. |
| 23 | + |
| 24 | +If the **Sensitivity label** setting isn't available, you might not have the required usage rights to change it. In that case, contact the person who originally applied the label or your security administrator. |
| 25 | + |
| 26 | +## Apply sensitivity labels in Power BI Desktop |
| 27 | + |
| 28 | +You can also apply sensitivity labels to .pbix files directly in Power BI Desktop. This protects the file before it's ever published to the Power BI service, which matters when files are shared via email, stored on local drives, or uploaded to locations outside of Power BI. |
| 29 | + |
| 30 | +To apply a label in Desktop: |
| 31 | + |
| 32 | +1. Select the **Sensitivity** option on the toolbar. |
| 33 | +1. Select the appropriate sensitivity label from the dropdown list. |
| 34 | + |
| 35 | +After you apply the label, it's visible in the status bar at the bottom of the Desktop window. |
| 36 | + |
| 37 | +When you publish a labeled .pbix file to the Power BI service, Power BI applies the label to both the report and the semantic model it creates. If the file replaces existing assets, you're prompted to choose whether to keep the existing labels or apply the .pbix file's label. |
| 38 | + |
| 39 | +## How labels flow through Power BI |
| 40 | + |
| 41 | +One of the most valuable aspects of sensitivity labels in Power BI is how they propagate automatically through the content lifecycle. Understanding these inheritance behaviors helps you apply labels strategically rather than manually labeling every item. The most effective starting point is your semantic models: label them first, and every report and dashboard built from them inherits that classification automatically. |
| 42 | + |
| 43 | +### Inheritance when creating new content |
| 44 | + |
| 45 | +When you create a new report from a labeled semantic model, the report automatically inherits the semantic model's sensitivity label. The same applies when you create a dashboard from a labeled report. This inheritance means labeling your upstream semantic models has a cascading effect on everything built from them. |
| 46 | + |
| 47 | +### Downstream inheritance |
| 48 | + |
| 49 | +When you apply or change a sensitivity label on a semantic model or report, Power BI can automatically propagate that label to all dependent content downstream. For example, labeling a semantic model as **Highly Confidential** can push that label to every report and dashboard built from it. |
| 50 | + |
| 51 | +Downstream inheritance operates in two modes, controlled by a tenant setting: |
| 52 | + |
| 53 | +- **User consent mode** (default): When you apply a label, a checkbox asks whether to also apply it downstream. Users can opt out. |
| 54 | +- **Fully automated mode**: Labels propagate automatically without user input. |
| 55 | + |
| 56 | +In both modes, downstream inheritance never overwrites a label that was manually applied, and it never replaces a label with a less restrictive one. |
| 57 | + |
| 58 | +### Inheritance from data sources |
| 59 | + |
| 60 | +Power BI semantic models that connect to labeled data in supported sources can inherit those labels automatically. Currently supported data sources include Azure Synapse Analytics, Azure SQL Database, and Excel files stored in OneDrive or SharePoint Online. This capability must be enabled through the tenant setting **Apply sensitivity labels from data sources to their data in Power BI**. |
| 61 | + |
| 62 | +## What happens when you export labeled data |
| 63 | + |
| 64 | +When you export data from Power BI to Excel, PowerPoint, PDF, or .pbix files, the sensitivity label travels with the exported file. If the label includes encryption settings, Power BI encrypts the exported file automatically. For example, if someone exports a financial projections dashboard labeled **Confidential** to a PDF for a client presentation, the PDF inherits the label and its encryption. The recipient still needs the right permissions to open it. |
| 65 | + |
| 66 | +A few things to keep in mind about exports: |
| 67 | + |
| 68 | +- Export to unsupported formats like .csv or .png doesn't carry the sensitivity label or protection. |
| 69 | +- When you download a .pbix file and the report and semantic model have different labels, Power BI applies the more restrictive label to the downloaded file. |
| 70 | +- Content markings configured on the label (such as headers and footers) aren't applied to exported files automatically. They appear when the file is opened in an Office desktop app. |
| 71 | + |
| 72 | +## Considerations for Power BI label management |
| 73 | + |
| 74 | +As you roll out sensitivity labels in Power BI, consider these operational factors: |
| 75 | + |
| 76 | +- **Mandatory labeling**: Label policies can require users to apply a sensitivity label before saving Power BI content. Mandatory labeling is fully supported for Power BI items. |
| 77 | +- **Workspace admin overrides**: Automated labeling scenarios can sometimes result in labels that no user has permission to change. The tenant setting **Allow workspace admins to override automatically applied sensitivity labels** addresses this limitation by giving workspace admins the ability to change automatically applied labels. |
| 78 | +- **Embedded reports**: Sensitivity labels persist in embedded reports and dashboards, including when embedded in Teams, SharePoint, or organizational apps. The label remains visible in the embedded view. |
| 79 | +- **Mobile apps**: Sensitivity labels are visible on reports and dashboards in the Power BI mobile apps for iOS and Android. |
| 80 | + |
| 81 | +For more information on applying sensitivity labels in Power BI, see [How to apply sensitivity labels in Power BI](/fabric/enterprise/powerbi/service-security-apply-data-sensitivity-labels?azure-portal=true). For the full overview of sensitivity label capabilities in Power BI, see [Sensitivity labels in Power BI](/fabric/enterprise/powerbi/service-security-sensitivity-label-overview?azure-portal=true). |
0 commit comments