In Part two of this series, we walked through how to configure your Microsoft Fabric environment to securely share Power BI reports with external users across Microsoft 365 tenants. We covered licensing requirements, admin portal settings, how to invite guest users, and how to share reports directly with them.
Now, in the third and final part of this blog series, we focus on two important areas that are often overlooked:
- What happens when Microsoft Purview sensitivity labels are applied to a report
- How to refine admin portal settings to better control guest users’ access to Fabric
This series was originally created to support a YouTube video I published in April 2025. The topic turned out to be too broad to explain well in one blog, so I decided to split it into three parts.
Here is the complete series:
- Part 1: Understanding the Problem and Core Concepts
This post explains why external sharing can be tricky, the key requirements to get it working, important terminology, user roles, and how the whole process fits together. - Part 2: Hands-On Guide to Setup and Sharing
A step-by-step walkthrough of how to share reports across tenants, covering licensing, admin portal settings, inviting guest users, and how report access looks from the guest’s side. - Part 3: Sensitivity Labels, Encryption, and Secure Sharing (this blog)
In this last part, we will look at what happens when Microsoft Purview sensitivity labels are applied, including access control, and will also discuss key admin settings you may need to adjust for more secure collaboration.
If you like to listen to the content on the go, here is the AI generated podcast explaining everything about this blog 👇.
If you are someone who prefers video over reading, you can watch the full walkthrough here 👇.
Let’s now get into the final piece of this guide.
Sensitivity Labels in Microsoft Fabric
Microsoft Purview sensitivity labels are part of a broader Purview Information Protection framework. These labels are not exclusive to Microsoft Fabric or Power BI. They are designed to be consistently applied across various Microsoft services, including but not limited to Outlook, Word, Excel, SharePoint, and Azure SQL DB. This ensures that data is classified and protected uniformly, regardless of where it is created, stored, or shared. In the context of Power BI, when you apply a sensitivity label to a report, it adds classification metadata and, if configured, applies protection such as encryption and access restrictions. These protections travel with the content. For example, if a report is exported to PDF or PowerPoint, and the label has encryption enabled, that exported file will also be encrypted. So only the users who are authorised to view the content will be able to open it, even outside of the Power BI service. This means your data remains secure not only inside your tenant but also when it moves across users, devices, and even organisations.
What Happens When You Share Encrypted Reports?
Let’s walk through an example.
You share a Power BI report with a guest user. This report has a label applied that encrypts its content. Here is what the guest user can and cannot do:
Continue reading “Sharing Power BI Reports with External Users – Part 3: Sensitivity Labels, Encryption, and Secure Sharing”