Protecting Sensitive Data in Power BI Dashboards from admins

[NMe]

Hi All,

I’m looking for a solution for the following Power BI dashboard scenario:

I’ve been requested to design a dashboard based on highly sensitive data. The content should not be accessible even to Power BI admins. The solutions I’ve explored are:

1. Importing Masked/Encrypted Data: How can we unmask or decrypt the data for authorized users?

2. Using Sensitivity Labels: Applying sensitivity labels to the data source before designing the dataflow. However, it seems that labels do not work within the Power BI environment and only apply when data is exported.

3. Using Row-Level Security (RLS): Combining RLS with the above solution. The issue here is that admins can change the RLS settings and view the sensitive data.

4. Custom Encryption Keys: I’m unsure if "Bring Your Own Encryption Key" would be effective in this case.

I would appreciate your thoughts and suggestions on addressing this issue.

Thanks!

[NMe]

Thanks for your answer. I meant the admin role in Power BI. If I have the datasource encrypted, is there any component to decrypt it for authorized users?

[v-zhouwen-msft]

Hi @NMe ,

Regarding your question, is the administrator you mentioned Frabic admin or the administrator role of the workspace?If you are referring to the Admin role of the workspace, then RLS will be disabled (RLS only works for viewer role).You may need to encrypt at the data source.If you are referring to a Frabric administrator, you only need to set up RLS in Desktop (if the connection mode is Live Connection, you need to set up RLS in the data source). Then publish to your workspace, just make sure that the user who cannot access the data has the role of viewer in the workspace.

When they try to access it they get the following error.

Best Regards,
Wenbin Zhou