How to Apply Sensitivity Labels in Power BI

Applying sensitivity labels in Power BI is one of the most effective ways to protect your business information from accidental leaks. It lets you classify reports, dashboards, and datasets based on their confidentiality, ensuring that sensitive data is handled properly. This guide will walk you through exactly how to set up, apply, and manage these labels for better data governance and security.

We'll cover how to apply labels in Power BI Desktop and the Power BI service, and explain how they automatically protect your data even when it's exported to other file formats like Excel or PDF.

What Are Sensitivity Labels in Power BI?

If you've ever used Microsoft Office applications like Word or Excel, you might have seen prompts to classify your documents as "Public," "Confidential," or "Internal Use Only." Sensitivity labels in Power BI work on the same principle, but are tailored specifically for data analytics assets. They are a core feature of Microsoft Purview Information Protection, designed to help organizations classify and protect their data wherever it lives.

Think of them as digital tags that you attach to your Power BI content. These tags do two critical things:

• They Classify Content: At its most basic, a label provides a clear, visual indicator of the data's sensitivity. When a user opens a report labeled "Highly Confidential," they immediately understand the level of care required when handling that information. This helps build a culture of data awareness.
• They Protect Content: Labels aren't just for show. They can be configured to enforce protection policies. For example, a "Confidential" label can automatically apply a watermark to a report, prevent users from exporting the data, or even encrypt the file when it is downloaded.

This allows you to control a report's entire lifecycle. A sales report containing customer data can be classified as confidential, and even if an authorized user exports it to Excel, the sensitivity label and its protection rules (like encryption) will travel with the exported file.

Prerequisites: Getting Ready to Use Sensitivity Labels

Before you can start applying labels, you'll need a few things in place. Some of these steps require an administrator, so you may need to coordinate with your IT or data governance team.

• Licensing: End-users who apply or view labels need a Power BI Pro or Premium Per User (PPU) license. Additionally, your organization needs a license that includes Microsoft Purview Information Protection. This is typically included in licensing bundles like Microsoft 365 E5 or E3.
• Labels Must Be Created and Published: Sensitivity labels aren't created inside Power BI. An administrator must define and publish them for your organization in the Microsoft Purview compliance portal. These are the same labels used across Outlook, Word, Excel, and more.
• Feature Enablement in Power BI: A Power BI administrator must enable sensitivity labels in the Power BI tenant settings. Without this, the labeling options won't appear for users.

For Power BI Admins: How to Enable Sensitivity Labels in Your Tenant

If you're a Power BI administrator, enabling this feature is straightforward. Follow these steps:

1. Navigate to the Power BI Service (app.powerbi.com) and click the gear icon in the top right corner. Select Admin portal.
2. In the Admin portal, click on Tenant settings.
3. Scroll down to the Information protection section.
4. Find the setting titled "Allow users to apply sensitivity labels for Power BI content" and enable it. You can choose to enable it for the entire organization or for specific security groups.
5. Underneath this setting, you may see other related options, such as applying sensitivity labels from data sources to their data in Power BI. Enabling these can further automate your data governance.

Once you've saved these changes, the sensitivity labeling features will begin to roll out to your users.

Step-by-Step Guide: How to Apply Labels in Power BI Desktop

Most Power BI development happens in Power BI Desktop, so this is the most common place to apply a label for the first time. The process is simple and integrated directly into the workflow.

1. Open your Power BI report (.pbix file) in Power BI Desktop.
2. In the Home tab of the ribbon, look for the Sensitivity button. Its location might vary slightly based on your screen resolution, but it's typically in the "Security" section.
3. Click the Sensitivity button. A dropdown menu will appear showing all the sensitivity labels that your administrator has published for you.
4. Select the label that best describes the data in your report. For instance, if you're working with internal financial data, you might choose an "Internal - Confidential" label.
5. Once you select a label, you'll see a confirmation in the status bar at the bottom of the Power BI Desktop window. It will display the applied label, confirming that your report is now classified.

That's it! When you save and publish the report to the Power BI service, this label will be published along with it and automatically applied to both the report and its underlying dataset in the service.

How to Apply Sensitivity Labels in the Power BI Service

You can also apply or change labels on content that already exists in the Power BI service. This is useful if you need to update a report's classification or apply labels to datasets and dataflows directly.

Applying a Label to a Report or Dashboard

1. Navigate to the workspace containing the report or dashboard you want to classify.
2. Find the content in the list view. You can either look for the 'Sensitivity' column or open the item.
3. If viewing a report, you'll see the sensitivity label status next to the report's title at the top of the page. You can click on it to change the label.
4. Alternatively, for reports and dashboards, click the three-dot menu (...) for more options and select Settings.
5. In the Settings pane, you'll find a Sensitivity label section. Click the dropdown menu and select the correct label.

Applying a Label to a Dataset or Dataflow

1. Go to the workspace containing the dataset or dataflow.
2. Find the item you wish to label in the list.
3. Click the three-dot menu (...) and go to Settings.
4. In the settings pane that opens, find the Sensitivity label section.
5. Choose the appropriate label from the dropdown list and click Apply.

Understanding Label Inheritance and Persistence

One of the most powerful aspects of sensitivity labels in the Power BI ecosystem is how they automatically protect your data as it moves between different states and services. Two concepts are key here: inheritance and persistence.

Label Inheritance

Inheritance ensures that sensitivity classifications are automatically applied downstream, reducing the risk of human error.

• On Publish: As mentioned, when you publish a labeled .pbix file from Power BI Desktop to the service, both the resulting report and its dataset automatically inherit that same label.
• Between Connected Items: If you change a dataset's label in the Power BI service, the service will prompt you on whether you'd also like to apply that new label to the connected reports and dashboards.
• From Data Sources: If your organization uses sensitivity labels in data sources like Azure Synapse Analytics or Azure SQL Database, Power BI can be configured to automatically inherit these labels when you connect to that data. This means the data is protected from the moment it enters Power BI.

Persistence on Export

Persistence is what prevents data leakage outside of the Power BI ecosystem. When you apply a sensitivity label that is configured with protection policies, those policies stick to the data when it’s exported.

Consider a report labeled "Highly Confidential - All Employees". This label might be configured with the following rules:

• The data cannot be screenshotted.
• A "CONFIDENTIAL" watermark is applied to pages.
• The data can only be accessed by full-time employees within the company.

When a user with permission exports this report's visualized data to an Excel or PDF file, Power BI applies the same sensitivity label to the exported file. That new Excel file will now be encrypted and can only be opened by authorized employees. This ensures the data remains protected even after it has left the Power BI service.

Best Practices for a Successful Rollout

Implementing a new data governance process takes more than just flipping a switch. Here are a few tips to ensure your team adopts sensitivity labels effectively.

• Provide Clear Guidance: Create simple documentation that tells users what each label means. Is "Confidential" just for financial data, or also HR information? Clear definitions prevent confusion.
• Start Small: You don't need twenty different labels on day one. Start with a simple scheme, like Public, Internal, Confidential, and Highly Confidential, and expand only if necessary.
• Use Default and Mandatory Labeling: Your PBI Admin can set policies in Microsoft Purview to require labels. For instance, you can set a default label (like Internal) on all new content or make it mandatory for a user to apply a label before they can save a report.
• Communicate and Train: Announce the rollout ahead of time and hold a brief training session showing users where the button is and explaining why it matters. A little context goes a long way in driving adoption.

Final Thoughts

Turning on sensitivity labels elevates Power BI from a powerful data visualization tool to a secure, governable analytics platform. By classifying your reports, datasets, and dashboards, you take a massive step towards preventing data leaks, meeting compliance requirements, and ensuring sensitive commercial information stays in the right hands.

Securing your data within analytics platforms is just one part of the puzzle, the first step is often unifying your disparate data sources. Many marketing and sales teams struggle to get a complete view when their data is spread across HubSpot, Google Analytics, Shopify, and a dozen other platforms. At Graphed, we solve this by providing one-click integrations to your favorite tools. Our platform helps you use natural language to instantly build a unified dashboard, so you can stop manually exporting CSVs and get back to finding insights that grow your business.