Quick Answer
Microsoft Purview is the governance and compliance backbone for enterprise Power BI in 2026. It provides lineage, classification, sensitivity labels, DLP, and audit in a single control plane. Every regulated Power BI deployment should onboard Purview within the first 90 days of production launch.
1. Data Lineage Visualization
Lineage answers two questions. Upstream: where did this data come from? Downstream: what reports depend on this source?
Purview's unified catalog scans Power BI and produces a graph showing every source connection, dataflow, dataset, report, and app. Click any node to see dependencies. Click an edge to see transformation details. For compliance, lineage is the single most important governance artifact because it provides defensible answers to auditor questions about data provenance.
Onboarding is straightforward: register the Power BI tenant as a data source in Purview and schedule regular scans. Scans typically complete in 2 to 6 hours for a mid-size tenant. Incremental scans after the initial onboarding complete in 15 to 30 minutes.
2. Sensitivity Labels for Power BI
Sensitivity labels classify content by confidentiality level. Typical label taxonomy:
- Public: shareable outside the organization.
- General: internal use only, no external sharing.
- Confidential: sensitive, requires encryption and restricted sharing.
- Highly Confidential: strictest controls, often requires additional justification for access.
- Regulated (custom): industry-specific labels for HIPAA, SOC 2, FedRAMP content.
When a user exports a labeled dataset to Excel, the label propagates and Excel enforces the encryption and permission rules. This prevents data leakage when content leaves Power BI.
3. DLP Policies for Power BI
DLP policies automate enforcement. Example policies:
- Block export of Highly Confidential content. Users cannot export to Excel, PDF, or PPT.
- Require justification for download of Confidential content. User enters a business reason which is logged for audit.
- Prevent sharing of labeled content outside the organization. Invitations to external users are blocked or require approval.
- Block Copilot access to datasets tagged with certain labels. For organizations that restrict AI processing of regulated data.
Policies can be in audit-only mode (log violations without blocking) or enforce mode (prevent the action). Roll out new policies in audit mode for 30 to 60 days to understand baseline behavior, then switch to enforce.
4. Unified Audit Log
Every Power BI action produces an audit event. Key event types to monitor:
- ViewReport, ViewDashboard, ViewSemanticModel: consumption events.
- ExportReport, ExportUsageMetrics: data exfiltration signals.
- ShareReport, UpdateApp: sharing and distribution.
- AddUserToGroup, UpdateCapacity: administrative changes.
- DeleteReport, DeleteSemanticModel: destructive operations.
- CopilotInvocation: AI usage (if Copilot audit is enabled).
Build monitoring dashboards that track key metrics: top exporters, users with anomalous access patterns, failed RLS queries, and Copilot prompt patterns. Integrate with Microsoft Sentinel for 24x7 security monitoring.
5. 90-Day Implementation Plan
- Days 1-14: Onboard Purview, register Power BI tenant, schedule initial scan. Establish label taxonomy with compliance team.
- Days 15-30: Deploy sensitivity labels. Pilot with a small set of content owners. Train content developers.
- Days 31-60: Apply labels to top 20 percent of datasets by usage. Enable auto-classification for well-understood sensitive data types.
- Days 61-75: Deploy DLP policies in audit mode. Monitor violations for baseline understanding.
- Days 76-90: Switch highest-priority DLP policies to enforce mode. Publish governance scorecards to leadership.
Frequently Asked Questions
What is Microsoft Purview?
Microsoft Purview is a unified data governance platform that discovers, classifies, and protects data across Microsoft 365, Fabric, Power BI, Azure, and multi-cloud data estates. Purview includes a data catalog, data lineage visualization, sensitivity labels, data loss prevention policies, unified audit logs, and information protection. For Power BI, Purview is the primary governance surface for classification, lineage, and compliance reporting.
How does Purview show Power BI lineage?
Purview scans Power BI tenants and captures lineage from source data systems through datasets to reports, dashboards, and apps. A single lineage graph shows that an Azure SQL table flows into a dataflow, which feeds a dataset, which powers three reports consumed by two apps. For data engineers and compliance officers, this visualization answers the "where did this number come from" question in seconds instead of days.
What are sensitivity labels?
Sensitivity labels classify content by confidentiality level (General, Confidential, Highly Confidential, and custom labels). Applied to Power BI datasets and reports, labels propagate to exports (Excel, PDF, PowerPoint) and influence DLP policy enforcement. Labels can be applied manually by content owners or auto-applied based on content scanning. For regulated industries, sensitivity labels provide the technical control that maps to data classification policy.
Can Purview auto-classify Power BI content?
Yes. Purview scans Power BI datasets and identifies sensitive data types (credit card numbers, social security numbers, email addresses, custom patterns defined in Purview). It can then auto-apply sensitivity labels based on the data it finds. Auto-classification is the standard pattern for large estates where manual labeling is impractical. Review auto-classifications periodically to ensure accuracy.
What is DLP for Power BI?
Data Loss Prevention policies monitor and restrict actions on Power BI content based on sensitivity labels and content classification. A DLP policy might prevent export of Highly Confidential datasets, block sharing of Confidential content outside the organization, or require justification for downloading labeled content. DLP policies are configured in the Purview compliance portal and apply automatically to matching content.
How does audit logging work with Purview?
Every Power BI activity (view, export, share, refresh, role change, delete) produces an audit event that flows into the Microsoft 365 unified audit log within 30 to 90 minutes. Purview provides the query and reporting interface over the audit log. For long-term retention and correlation with other security data, forward audit events to Microsoft Sentinel or another SIEM. Audit data is the primary evidence source for SOC 2, HIPAA, and FedRAMP compliance attestations.
Do Copilot activities get audited through Purview?
Yes. Purview captures audit events for every Copilot invocation when Copilot audit is enabled in the compliance portal. Events include the user identity, the prompt text, the Power BI artifact queried, and the returned response. For organizations deploying Copilot at scale, this audit trail is essential for detecting misuse, investigating incidents, and demonstrating compliance with AI governance policies.
What does Purview licensing cost?
Purview governance features (data catalog, lineage) are licensed through Microsoft 365 E5 or standalone Purview Data Governance licenses. Sensitivity labels and DLP are included in Microsoft 365 E5 Compliance or can be purchased as add-ons. For regulated industries, the E5 bundle is typically the most cost-effective path. Exact pricing depends on seat count and Microsoft agreement terms. Budget approximately $30 to $55 per user per month for full Purview + M365 E5 coverage.
Deploying Purview for Power BI?
Our consultants onboard Purview, design label taxonomies, and deploy DLP policies for regulated Power BI estates. Contact us for a governance review.