Governance

[Mmoustaqssa]

Hello,

I am working with a client in the banking sector who uses Power BI Service. In the country where I operate, there are strong regulatory constraints around data residency and data processing in the cloud, and outsourcing or processing sensitive data outside the country is highly restricted.

The client is concerned about where data is stored, processed, and accessed when using Power BI Service, and would like to ensure compliance with banking regulations, data sovereignty, and security requirements.

I would like to know if Microsoft provides official documentation (compliance guides, or regulatory references) that clearly explain:

• Data residency and regional data storage for Power BI Service

• How customer data is protected and isolated

• Compliance with financial services and banking regulations

• Security, encryption, and access controls in Power BI Service

The goal is to provide official Microsoft documentation to reassure the client and support internal compliance and audit discussions.

Thank you in advance for your guidance.

[Mmoustaqssa]

For banking customers, which specific compliance artifacts should be provided during audits to demonstrate Power BI compliance 

[v-karpurapud · Accepted solution]

Hi @Mmoustaqssa 

Microsoft offers formal, audit-ready compliance documents for Power BI, specifically designed for banking and highly regulated financial-services organizations. These are available through the Microsoft Trust Center and the Microsoft Service Trust Portal, where authorized customers can access independently audited reports such as SOC 1 Type II, SOC 2 Type II, SOC 3, ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701, PCI DSS (where applicable), and GDPR compliance documentation. All these documents include Power BI as a covered service.

Additionally, Microsoft provides detailed security resources, including the Power BI Security White Paper Power BI security white paper - Power BI | Microsoft Learn and the Power BI Data Protection and Security OverviewData protection in Power BI - Microsoft Fabric | Microsoft Learn, which cover topics like data residency, tenant isolation, encryption, access controls, and operational security. These materials are commonly used by banks for internal risk assessments and regulatory audits, demonstrating that Power BI benefits from Azure’s regulated cloud compliance, including region-locked data residency, strong logical isolation, and enterprise-grade security controls validated by independent third-party audits.

If you have any more questions, please let us know and we’ll be happy to help.

Regards,

Microsoft Fabric Community Support Team.
 

[v-karpurapud]

Hi @Mmoustaqssa 

Thank you for reaching out to the Microsoft Fabric Community Forum. 

Please take a moment to review the details shared by @Vinodh247 , @GilbertQ and confirm whether they align with your expectations. Let us know if you require any additional assistance or clarification.

Regards,

Microsoft Fabric Community Support Team.

[GilbertQ]

Hi @Mmoustaqssa 

Here is the link below where you can find all the information from the Microsoft Trust Center exactly explaining how data is used and where it lives. Microsoft Trust Center Overview | Microsoft Trust Center

[Vinodh247]

Microsoft clearly documents that PBI data is stored in the customer’s selected tenant region and does not move outside that geography unless explicitly configured. Datasets, reports, dashboards, and metadata remain within the assigned Azure datacenter region.

How customer data is protected and isolated?
PBI uses a multi-tenant architecture with strong logical isolation between tenants. Customer data is isolated at the storage, compute, and identity layers, backed by Azure Active Directory tenant boundaries. Microsoft states that customer data is not accessible to other tenants or Microsoft personnel without controlled, audited access. 

https://learn.microsoft.com/en-us/power-bi/guidance/white-paper-powerbi-security

https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-security-data-protection-overvie...

Compliance with financial services and banking regulations
Microsoft publishes a formal compliance mapping for PBI covering ISO 27001, ISO 27018, SOC 1/2/3, PCI DSS, GDPR, and country specific financial regulations where applicable. Banking clients typically rely on SOC reports and ISO certifications during audits. 

Security, encryption, and access controls
PBI encrypts data at rest and in transit using Microsoft managed keys by default, with support for customer-managed keys (BYOK) in Premium capacities. Access is controlled via Azure Active Directory, role-based access control, row-level security, conditional access, and audit logs. 

How to position this to the bank?
PBI is built on Azure’s regulated cloud foundation. Data residency is region locked, security controls are enterprise-grade, and compliance evidence is independently audited and published by Microsoft. From a regulator’s perspective, PBI inherits Azure’s banking grade compliance posture rather than being a standalone SaaS risk.