Microsoft data classification and PowerBI

[dmarques]

Hi,

My company is starting a data classification project using Microsoft Purview. We've defined 3 levels of classification, which are Public, Internal and Confidential. The Internal and Confidential data is encrypted as well.

We have a lot of excel files which are used to feed some PowerBI Dashboards, and of course, now users are complaining that PowerBI is not able to read the files. Of course we can remove the data classification for these files, but it doesn't make much sense as they are internal.

I can imagine that Microsoft may have some solution for this, but didn't found out nothing that worked well. Anyone had such experience?

Thanks

[v-karpurapud]

Hello @dmarques

Thank you for reaching out to the Microsoft Community Forum. It seems your issue is related to Power BI's inability to access Excel files that have been encrypted using Microsoft Purview sensitivity labels.

Power BI does not natively support reading encrypted Excel files with sensitivity labels, as it lacks built-in decryption capabilities and may not have the necessary permissions. However, there are a few possible solutions:

1. Use Sensitivity Labels Without Encryption : If encryption is not mandatory, you can apply sensitivity labels without enabling encryption. This allows Power BI to read the data while maintaining classification.
   
   
2. Modify Sensitivity Labels in Microsoft Purview : Update the sensitivity label in Microsoft Purview > Information Protection > Labels to remove encryption while retaining classification. Once updated, reapply the label to the affected files.
   
   
3. Enable Microsoft Information Protection (MIP) Sensitivity Labels in Power BI : Configure MIP sensitivity labels within Power BI to ensure it respects the classification while allowing access.
   
   

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you!

[dmarques]

Hi,

Thanks for the reply and clarifications. Do you have any official Microsoft link with that information?

I really think it's kind of strange that Microsoft has one product to encrypt data and another product, within the same ecosystem which can't decrypt that data. It doesn't make much sense.

Thanks

[v-karpurapud]

Hello @dmarques 

At present, there is no specific Microsoft documentation that directly addresses this particular issue. However, there are relevant resources that provide insights into Microsoft Purview sensitivity labels and their integration with Power BI. Kindly refer to the following official Microsoft documentation:

Sensitivity labels from Microsoft Purview Information Protection in Power BI - Power BI | Microsoft
...
Enable sensitivity labels in Fabric and Power BI - Power BI | Microsoft Learn
Apply encryption using sensitivity labels | Microsoft Learn


If you find this post helpful, please mark it as an "Accept as Solution" and give a KUDOS.

Thank You!

[dmarques]

Thanks for the references. Well, it's still kind of odd that Microsoft doesn't state clearly if it's supported or not. Also on one of articles is says this:

So if it doesn't work with offline files, it should with online files, or am I misunderstanding?

Thanks

[v-karpurapud]

Hi @dmarques 

We understand your concern. To clarify, Power BI does not support opening encrypted files (whether online or offline) when they are protected with Microsoft Purview sensitivity labels that include encryption.

The note you referenced refers to offline access limitations, meaning that even if encryption settings allow offline access, certain apps such as Power BI Desktop still won't open encrypted files when offline. However, this does not imply that Power BI can open encrypted files when online.

1. Power BI does not natively support decrypting Purview-encrypted files, whether stored online or offline.
   
2. Even when files are stored in SharePoint Online or OneDrive, Power BI is unable to process them if they are encrypted with Purview sensitivity labels.
   
3. Power BI currently supports sensitivity labels for reports, dashboards, and datasets but not for encrypted data sources.
   
   
   

Thank You!

[dmarques]

Hi,

We've found the solution which works in 2 scenarios, and we're just missing one scenario.

So we've enabeld 2 options on PowerBI tenant admin:

And now we can read encrypted excel files readed directly on PowerBI or via link. 

The only thing we can't do is to read power query via excel files, which prompt this error on Power BI:

Thanks

[v-karpurapud · Accepted solution]

Hello @dmarques 

Thank you for the update. Glad to hear that you’ve found a solution that works in most scenarios.

Regarding the issue with Power Query reading encrypted Excel files, I had previously shared a reference link in my earlier response that provides relevant information on this limitation. You may not have had a chance to review it yet, so here it is again for your reference:

Enable sensitivity labels in Fabric and Power BI - Power BI | Microsoft Learn

As the issue has been resolved, kindly consider marking this as the Accepted solution to help others find it easily.

Thank You.