Enable sensitivity labels in Power BI

In order for Microsoft Information Protection sensitivity labels to be used in Power BI, they must be enabled on the tenant. This article shows Power BI tenant administrators how to do this. For an overview about sensitivity labels in Power BI, see Sensitivity labels in Power BI. For information about applying sensitivity labels in Power BI, see Applying sensitivity labels

When sensitivity labels are enabled:

  • Specified users and security groups in the organization can classify and apply sensitivity labels to their Power BI reports, dashboards, datasets, and dataflows.
  • All members of the organization can see those labels.

Enabling sensitivity labels requires an Azure Information Protection license. See Licensing for detail.

Enable sensitivity labels

Go to the Power BI Admin portal, open the Tenant settings pane, and find the Information protection section.

Find the Information Protection section

In the Information Protection section, perform the following steps:

  1. Open Allow users to apply sensitivity labels for Power BI content.

  2. Enable the toggle.

  3. Define who can apply and change sensitivity labels in Power BI assets. By default, everyone in your organization will be able to apply sensitivity labels. However, you can choose to enable setting sensitivity labels only for specific users or security groups. With either the entire organization or specific security groups selected, you can exclude specific subsets of users or security groups.

    • When sensitivity labels are enabled for the entire organization, exceptions are typically security groups.
    • When sensitivity labels are enabled only for specific users or security groups, exceptions are typically specific users.
      This approach makes it possible to prevent certain users from applying sensitivity labels in Power BI, even if they belong to a group that has permissions to do so.
  4. Press Apply.

Enable sensitivity labels

Important

Only Power BI Pro users who have create and edit permissions on the asset, and who are part of the relevant security group that was set in this section, will be able to set and edit the sensitivity labels. Users who are not part of this group won’t be able to set or edit the label.

Troubleshooting

Power BI uses Microsoft Information Protection sensitivity labels. Thus if you encounter an error message when trying to enable sensitivity labels, it might be due to one of the following:

  • You do not have an Azure Information Protection license.
  • Sensitivity labels have not been migrated to the Microsoft Information Protection version supported by Power BI. Learn more about migrating sensitivity labels.
  • No Microsoft Information Protection sensitivity labels have been defined in the organization. Note that to be usable, a label must be part of a published policy. Learn more about sensitivity labels, or visit the Microsoft security and compliance center to read about how to define labels and publish policies for your organization.

Considerations and limitations

See Sensitivity labels in Power BI for the list of sensitivity label limitations in Power BI.

Next steps

This article described how to enable sensitivity labels in Power BI. The following articles provide more details about data protection in Power BI.