Power BI tenant settings: the switches that shape your tenant
Power BI tenant settings are the switches an administrator uses to allow or block features for the organization. Each one can apply to everyone, to chosen security groups or to nobody. So they are the main lever for governance, from sharing and export to new AI features. However, Microsoft adds settings often. This page explains how they behave and which ones deserve attention first.
- Allow by security group
- Governance, not security
- Review on a rhythm
Last updated
What are Power BI tenant settings?
They are feature controls that cover the whole tenant. An administrator opens them from the admin portal, under Tenant settings. Microsoft is also placing them in the Govern section of the OneLake catalog, region by region.
Each setting answers one question. For example, may people publish to the web, export to Excel or create workspaces? The answer then applies to every workspace, unless the setting targets specific groups.
Changes do not always land at once. Microsoft notes that a change can take a short while to reach everyone. So wait before you tell a user to try again.
The three states a tenant setting can have
Almost every setting offers the same choices, which makes the page easier to read than it first looks.
Disabled
Nobody in the organization can use the feature. This suits anything you have not yet assessed, because turning it on later is easy.
Enabled for everyone
All users get the feature. It is the simplest state, but it also gives the least control, so use it for low-risk items.
Enabled for groups
Only members of named security groups get the feature. You can also exclude groups, which helps when most people qualify and a few do not.
Are tenant settings a security control?
Not quite. Microsoft describes them as a governance tool and says they are not a security measure. For example, turning off the export setting removes the button, but it does not remove a person's permission to query the data.
So real protection still comes from permissions. Workspace roles, row-level security and sensitivity labels decide what people can reach and what happens to exported files. Tenant settings then shape behavior on top of that base.
This distinction matters in an audit. If a control must stop data from leaving, a hidden button is not enough. Instead, combine the setting with proper access rules.
Power BI tenant settings worth reviewing first
Every tenant differs, but these groups of settings carry the most weight in a first review.
- Publish to web, which can make a report public
- Export and sharing settings for reports and data
- Sharing with external or guest users
- Who may create workspaces
- Copilot and other Azure OpenAI features
- Developer settings such as embedding and service principals
How to change Power BI tenant settings safely
A careless switch can block a whole department, so follow a simple routine.
Record the current state
First, note how each setting stands today. An export through the admin API or a plain screenshot both work as a baseline.
Use security groups
Then create groups for the people who need a feature. Groups let you open a setting step by step instead of all at once.
Tell people before you switch
After that, warn the affected teams. A feature that vanishes without notice creates support tickets and damages trust.
Check and document
Finally, confirm the result with a test account and write down the reason. The next administrator will then know why the setting stands as it does.
Who can change settings, and what about delegation?
A Fabric administrator changes settings for the tenant. However, Microsoft lets some settings pass down to capacity, domain or workspace admins. Those admins can then override the tenant choice within their own area.
Delegation helps large organizations, because one central team cannot know every need. Still, it also spreads responsibility. So decide on purpose which settings may be overridden.
Also watch for new arrivals. The settings page flags new and changed items at the top. Since a new setting can arrive enabled, a regular look keeps surprises small.
Power BI tenant settings: questions from admins
Where do I find Power BI tenant settings?
Open the Settings gear in the service, choose Admin portal and then Tenant settings. You need an administrator role to see the page. Microsoft is also moving these controls into the OneLake catalog under Govern, as a staged rollout. So the path on your screen may differ from an older guide.
How long does a tenant setting change take to apply?
Microsoft says a change can take a while to reach the whole organization, so it is not instant. Therefore make the change, wait, and then test with an account that should be affected. If the result still looks wrong after a reasonable wait, check whether a delegated override applies to that workspace or capacity.
Can a setting apply to some users and not others?
Yes. Most settings can target specific security groups, and many also accept groups to exclude. As a result, you can open a feature to a pilot team first. Use security groups and not individual names where you can, because group membership is easier to maintain than a long list inside each setting.
Do Power BI tenant settings stop data from leaving?
Not by themselves. They shape what the interface offers, but Microsoft is clear that they are not a security measure. A person with permission on a semantic model may still reach the data another way. So protect sensitive data with permissions, row-level security and labels, and treat the settings as a second layer.
Can you audit our tenant settings?
Yes. Power BI Agency reviews each setting with your administrator and explains the trade-offs in plain language. We are a division of Sataware Technologies and independent of Microsoft. The review runs online, and you keep a written record of every decision. It starts with a free 30-minute assessment.
Let's build your first dashboard together.
Tell us what you report on today. A consultant replies within 2 hours with next steps.
Trusted partners
Microsoft Solutions Partner · AWS Partner
Cloud & AI Platforms
Azure SQL, Microsoft Fabric and the data pipelines behind your reports.
AI Business Solutions
Power BI reporting on your Dynamics 365, Business Central and Power Platform data.
Security
Row-level security and Entra ID sign-in on every report and workspace.
Amazon Web Services
Power BI on your AWS data, with connectors for Redshift, Athena and S3.