Forum Discussion

imik's avatar
imik
Advocate I
1 year ago
Solved

Power BI & SharePoint – Securing Sensitive Data

Hi there, We have sensitive data stored in SharePoint (lists, files) that we need to visualize in Power BI service. However, we want to ensure that this data remains invisible to everyone, including...
Need Help
  • v-ssriganesh's avatar
    v-ssriganesh
    1 year ago

    Hi imik,
    Thank you for reaching out to the Microsoft Fabric Community.

    Your requirement is unique, and currently, Power BI does not offer a built-in feature that directly prevents Power BI Admins from accessing datasets. However, if this is a critical feature for your organization, I recommend submitting it to the Microsoft fabric ideas: New Idea - Microsoft Fabric Community

    If the idea gains enough upvotes, Microsoft may consider implementing it in a future update. Many Power BI and Fabric features have been introduced based on community feedback.

    If this helps, kindly Accept it as a solution and give a "Kudos" so other members can find it more easily.

    Thank you.

FabScone75's avatar
FabScone75
Helper I
3 months ago

Hello imik did you ever find a workable solution to this problem? We have a similar requirement where we have a workspace with salary information that we want to keep secure from everyone (including Fabric Admins), except for a small handful of users. If you did figure something out, please do share. 

  • imik's avatar
    imik
    Advocate I
    2 months ago

    Hi FabScone75,

    Unfortunately, we didn't find a way to technically prevent Admin access w zero possibility of workaround. In our case, we eventually solved it through data anonymization (after further analysis only aggregated stats were actually required, not the underlying detailed data).

     

    After revisiting the topic, my understanding is that within the current PBIS/FABRIC ecosystem there is no technical way to fully prevent Admin access once the data is loaded into Power BI Service; essentially once it becomes part of a dataset/semantic model.

     

    The SSAS/OLAP scenario I mentioned earlier could work because the security boundary remains outside of Power BI, while Power BI acts only as a presentation layer. Once the data is imported into a dataset/semantic model, there is always some path for a tenant/workspace Admin to access it.

     

    The closest approach would be to keep the data outside of Power BI entirely and use Power BI only as a presentation layer e.g. via live connection (not import, lakehouse storage, etc.).

     

    I see the “active encryption” idea more as a client-side encryption / zero-trust analytics concept, which would need to be implemented directly within the Microsoft Power BI engine; and as far as I know, this capability doesn't currently exist.

     

    I know this is probably not the answer you were looking for 😥.

     

    Best Regards,
    imik