What this check looks at
Checks Power BI’s “Allow users to apply sensitivity labels for content” setting: whether the organisation’s Microsoft Purview sensitivity labels can be applied to Power BI reports, dashboards and semantic models.
Checks Power BI’s “Allow users to apply sensitivity labels for content” setting: whether the organisation’s Microsoft Purview sensitivity labels can be applied to Power BI reports, dashboards and semantic models.
It needs sensitivity labels published in Microsoft Purview first. With it on, a label set on a report follows the data into Excel, PowerPoint and PDF exports.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is on and fails when it is off. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
Without labels, a Power BI report holding confidential figures looks like any other: exported to Excel or PDF it leaves with no marking and no encryption, while the same figures in a labelled Word document would carry both.
At a law firm, client billing figures were labelled Confidential in every Word and Excel file, but the Power BI report built on the same data carried no label. A partner exported it to Excel for a client meeting, and the file went out with no protection at all.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.6 covers this setting. ISO 27001 A.5.13 Labelling of information and the NCSC 10 Steps data security guidance apply.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Publish sensitivity labels in Microsoft Purview first: the setting does nothing until there are labels to apply.
Step by step
- Check who relies on it. Before changing it, ask the Power BI owners and developers whether anything depends on the current setting, so the change does not stop work that is meant to happen.
- Change the setting. In the Microsoft Fabric admin portal, open Tenant settings → Information protection → Allow users to apply sensitivity labels for content. Turn it on. Select Apply.
- Tell the people affected. Tell report owners the setting is on, and how to apply a label to their reports.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
None for people reading reports; the setting adds a protection.
How to confirm it worked
The Fabric admin portal shows the setting as the check asks, and the next assessment passes.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.a Understanding data |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.5.13 Labelling of informationA.5.12 Classification of information |
| CISA SCuBA | MS.POWERBI.7.1v1 Sensitivity labels enabled for Power BI |
| CIS M365 | 9.1.6 Ensure 'Allow users to apply sensitivity labels for content' is 'Enabled' |
| CIS Controls v8.1 | 3.7 Establish and maintain a data classification scheme (IG2) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)