Power BI sensitivity labels: what they protect and how
Power BI sensitivity labels mark content such as reports and semantic models with a classification like Confidential. They come from Microsoft Purview Information Protection, so the same labels people know from Office apply here. The label also travels with data on supported export paths. However, labels do not control who opens a report in the service. The details below follow Microsoft's documentation.
- Labels from Purview
- Protection follows exports
- Not an access control
Last updated
What are Power BI sensitivity labels?
A sensitivity label is a tag that states how sensitive a piece of content is. Your security team defines the labels in the Microsoft Purview portal. Authors then apply them to items in the service or to files in Desktop.
In the service, labels can sit on semantic models, reports, dashboards, dataflows and paginated reports. The label shows beside the item name, so readers see the classification before they export or share anything.
Labels are also visible in the mobile apps. As a result, a person reading on a phone gets the same signal as someone at a desk.
How labels behave across the service and Desktop
Three behaviors explain most of what people see once labels are switched on.
Protection on export
When data leaves through a supported path, such as Excel, PowerPoint or PDF, the label and its protection go with the file.
Inheritance
A new report or dashboard takes the label of the model it builds on. Labels can also flow to downstream items, so content stays consistent.
Policies
Admins can set a default label for new content and can make labeling mandatory. Then authors cannot save unlabeled work.
Do sensitivity labels restrict access to a report?
Not in the service. Microsoft states that labels there do not affect access to content. Power BI permissions, workspace roles and row-level security still decide who sees what. So a Confidential label on a report does not hide it from anyone.
The protection matters when data leaves. For example, a file exported to Excel carries the label, and its encryption settings then control who can open that file. However, Microsoft notes that some export formats, such as .csv, do not carry protection.
Desktop differs slightly. There, a label with encryption does control who can open the .pbix file. Therefore the same label can act as a marker in one place and as a lock in another.
How to roll out Power BI sensitivity labels
Most of the effort is agreement between people, and the switches come last.
Agree the label set
First, work with the security team on a short list of labels. Four clear levels serve people better than a dozen vague ones.
Check the requirements
Then read Microsoft's article on enabling labels. It lists the licenses and the tenant setting an admin must turn on.
Pilot with one group
After that, enable labels for one security group and a few workspaces. Watch how exports behave before everyone gets the feature.
Set policies and train
Finally, add default or mandatory label policies and explain the meaning of each label. People label well only when they understand the levels.
Limits of Power BI sensitivity labels to plan around
Labels are one layer, not the whole defense. Because they do not restrict access in the service, pair them with sound workspace roles and row-level security. Otherwise a well-labeled report can still reach the wrong reader.
Some scenarios fall outside support. Microsoft lists exceptions, for example template apps and certain cross-tenant cases. Since the list changes, check it before you promise coverage to an auditor.
Finally, labels need upkeep. The audit log records label changes, so someone should review it. Also revisit the policies when the organization adds new kinds of data.
Questions about Power BI sensitivity labels
Do Power BI sensitivity labels encrypt data in the service?
No. In the service a label marks the content and appears beside it, but it does not encrypt the item or limit who can open it. Protection applies when data leaves on a supported export path, such as Excel or PDF. So access inside Power BI still depends on permissions and security rules in the model.
What licenses do sensitivity labels need?
Microsoft documents that labels need an information protection license as well as a suitable Power BI license for people who apply them. The exact products and names have changed over time. Therefore read the current licensing section on Microsoft Learn. We do not resell licenses, so our advice on this stays neutral.
Are labels kept when a report goes to Excel?
Yes, on supported paths. An export to Excel, PowerPoint or PDF carries the label and its protection. Analyze in Excel and a download to a .pbix file keep it as well. However, a .csv export does not carry protection. For that reason, many admins limit which export formats people can use.
Who applies Power BI sensitivity labels to content?
Authors and owners apply them, as long as an admin has enabled labels for their group. A default label policy can also apply one automatically to new items. Inheritance then passes the label from a model to the reports built on it. As a result, most content gets a label without extra clicks.
Can you help us plan a labeling rollout?
Yes. Power BI Agency plans governance work, including labels, roles and export settings, together with your security team. We are a small team, a division of Sataware Technologies, and independent of Microsoft. The service runs online inside your own tenant. Start with a free 30-minute assessment of your current setup.
Let's build your first dashboard together.
Tell us what you report on today. A consultant replies within 2 hours with next steps.
Trusted partners
Microsoft Solutions Partner · AWS Partner
Cloud & AI Platforms
Azure SQL, Microsoft Fabric and the data pipelines behind your reports.
AI Business Solutions
Power BI reporting on your Dynamics 365, Business Central and Power Platform data.
Security
Row-level security and Entra ID sign-in on every report and workspace.
Amazon Web Services
Power BI on your AWS data, with connectors for Redshift, Athena and S3.