Enable sensitivity labels for Fabric and Power BI content

Description

The Fabric tenant setting Allow users to apply sensitivity labels for content (Information protection) is Enabled, for the entire organization or for the groups that create and manage content. Microsoft Purview sensitivity labels are already published to these users. Related settings are reviewed together: label inheritance from data sources and to downstream content, and Restrict content with protected labels from being shared via link with everyone in your organization.

Rationale

Fabric holds aggregated business data that is often more sensitive than the source documents. Labels make that sensitivity visible to users, feed data loss prevention and auditing, and carry encryption to files exported to Excel, PowerPoint or PDF. Without the tenant setting, labels published in Purview cannot be applied to Fabric items at all.

Impact

Users see a sensitivity menu on Fabric items; mandatory labeling or default labels, if configured in Purview, apply to new content. Exported files may become encrypted and readable only by users covered by the label. Applying labels requires a Power BI Pro or Premium Per User licence plus a Purview Information Protection licence for the user.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Information protection and expand Allow users to apply sensitivity labels for content.
3. Check that it is Enabled (entire organization, or the groups that publish content).
4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry EimInformationProtectionEdit.
5. Fail if the setting is disabled.

Remediation

1. Make sure sensitivity labels are published in Microsoft Purview to the users who will label Fabric content.
2. In Tenant settings > Information protection > Allow users to apply sensitivity labels for content, select Enabled, choose the scope, and Apply. Role: Fabric Administrator.
3. Review the inheritance settings (Apply sensitivity labels from data sources to their data in Power BI, Automatically apply sensitivity labels to downstream content) and enable Restrict content with protected labels from being shared via link with everyone in your organization.
4. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/EimInformationProtectionEdit/update with {"enabled": true}.

Rollback

Set the setting back to Disabled. Labels already applied stay on the items.

References

• Information protection tenant settings Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power BI baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-016 Restrict Power BI links that grant access to everyone in the organization
• requires CB-M365-DATA-005 Publish sensitivity labels to all users
• related CB-M365-DATA-006 Extend sensitivity labels to SharePoint, groups and sites, with default and automatic labelling

People and lifecycle