Sensitivity Labels & Governance | Guided by A Guide to Cloud

Protecting your data beyond Power BI

Simple explanation

Imagine stamping a document “CONFIDENTIAL.” That stamp follows the document everywhere — whether it’s on a desk, in an email, or stored in a filing cabinet. Anyone who sees the stamp knows to handle it carefully.

Sensitivity labels classify your Power BI content (Public, General, Confidential, Highly Confidential). The label travels with the data — even when exported to Excel or PDF — applying protection policies like encryption to exported files. Important: sensitivity labels are a classification and protection tool, not an access control tool. Who can access Power BI content is controlled by workspace roles, sharing, and RLS — not by labels.

How sensitivity labels work in Power BI

Applying labels

Where	How to Apply
Semantic model	Dataset settings → Sensitivity label → select label
Report	File → Info → Sensitivity label → select label
Dashboard	Dashboard settings → Sensitivity label → select label
Power BI Desktop	File → Info → Sensitivity label (if admin-enabled)

Label inheritance

Labels cascade downstream:

Label a semantic model → all reports built on it inherit the label
Label a report → dashboards pinned from it can inherit the label

This means Dr. Ethan at Bayview Medical (🏥) can label the patient dataset as “Highly Confidential” — and every report built on it automatically inherits that classification.

Label protection on export

When content with a sensitivity label is exported:

Export Format	Label Protection
Excel	Sensitivity label applied to the Excel file (with encryption if configured in label policy)
PDF	Sensitivity label metadata applied; content markings depend on label configuration
PowerPoint	Sensitivity label applied to the PPTX file
CSV	No label protection — CSV format doesn’t support sensitivity labels. Admin can restrict CSV export for labelled content.

Exam tip: sensitivity labels and licensing

Sensitivity labels in Power BI require:

Microsoft Purview Information Protection licence (included in E5 or as add-on)
Labels configured in the Purview compliance portal
Power BI admin setting enabled: “Allow users to apply sensitivity labels”

The exam tests whether you know that labels come from Purview (not Power BI itself), and that they persist on export.

Governance best practices

Beyond sensitivity labels, good Power BI governance includes:

Practice	What It Means
Endorsement	Promote and certify trusted datasets (covered in previous module)
Lineage view	Track data flow from source → dataset → report → dashboard
Impact analysis	See which reports are affected before changing a dataset
Usage metrics	Monitor who’s viewing reports and how often
Audit logs	Track all Power BI activities for compliance
Tenant settings	Admin portal controls for sharing, export, embedding, and external access

Lineage and impact analysis

Nadia at Prism Agency (📊) uses Lineage view (workspace → Lineage) to see the full data pipeline:

Google Ads API → Dataflow → Campaign Dataset → Campaign Report → Executive Dashboard

Before modifying the Campaign Dataset, she runs Impact analysis to see that 3 reports and 2 dashboards depend on it — so she knows what to test after changes.

Usage metrics

Riley at Coastal Fresh (🛒) checks usage metrics to see which reports are actually being used. She discovers the Operations report hasn’t been viewed in 3 months — she contacts the team to determine if it should be retired or updated.

Kenji at Apex Manufacturing (🏭) uses audit logs to confirm that only authorised users accessed the production data during a security review.

Knowledge check

Question

Where are sensitivity labels configured?

Click or press Enter to reveal answer

Answer

In the Microsoft Purview compliance portal — not in Power BI itself. Power BI applies labels that are defined centrally in Purview, providing a unified classification framework.

Click to flip back

Question

What happens when you export a labelled Power BI report to Excel?

Click or press Enter to reveal answer

Answer

The sensitivity label is applied to the exported Excel file — maintaining protection outside Power BI. If the label includes encryption, the Excel file is encrypted.

Click to flip back

Question

What is lineage view in Power BI?

Click or press Enter to reveal answer

Answer

A visual representation of data flow: from source → dataflow → dataset → report → dashboard. Helps you understand dependencies and the impact of changes.

Click to flip back

Knowledge Check

Dr. Ethan labels the patient dataset as 'Highly Confidential' in the Power BI service. A colleague creates a new report using that dataset. What sensitivity label does the report get?

Knowledge Check

Nadia wants to see which reports will be affected before she modifies a shared dataset. What feature should she use?

🎬 Video coming soon

Congratulations! You’ve completed all 26 modules of the PL-300 study guide. Review the modules you found challenging, test yourself with the flashcards, and use the practice questions to prepare for exam day. Good luck! 🎉