--- title: "How Does Purview Govern Microsoft Fabric and Power BI?" url: "https://atlan.com/know/ai-agent/microsoft/how-does-purview-govern-microsoft-fabric-and-power-bi/" description: "Purview governs Microsoft Fabric and Power BI with sensitivity labels, DLP, audit, insider risk and Data Map scans. What each control covers, and its limits." author: "Emily Winks" author_role: "Data Governance Expert" published: "2026-10-28" updated: "2026-10-28" --- > Atlan is hosting Context Conference, bringing together the leaders and builders at the frontier of giving AI the context it needs to understand their business. It runs online on October 28, 2026, from 11:00 AM to 2:00 PM ET. Atlan co-founder Prukalpa Sankar opens and closes the day. Leaders from AstraZeneca, BNY and Verizon share why they invest in context and what they get from it. Registrants get early access to The AI Context Gap, a new study from MIT Technology Review Insights. Register: https://atlan.com/context-conference/ ## How does Purview govern Microsoft Fabric and Power BI? Microsoft Purview governs Microsoft Fabric and Power BI with sensitivity labels, data loss prevention (DLP) policies, the audit log, insider risk indicators, and controls for Copilot. The OneLake catalog stays the main place to discover, endorse, and trace Fabric data, and Purview adds protection, audit, risk, and compliance on top. Purview's Data Map can also scan a Fabric tenant, Power BI included, to pull item metadata and lineage into the Purview Unified Catalog. ## Key takeaways - Fabric admins, domain admins, and data stewards work in the Govern section of the OneLake catalog. - Mandatory labeling is fully supported for Power BI items only. - Protection policies turn a label into access control. - Copilot coverage is narrower than the data coverage. --- [Microsoft Purview](https://atlan.com/know/ai-agent/microsoft/what-is-microsoft-purview/) governs Microsoft Fabric and Power BI with [sensitivity labels, data loss prevention (DLP) policies, the audit log, insider risk indicators, and controls for Copilot](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric). The [OneLake catalog stays the main place](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric) to discover, endorse, and trace Fabric data, and Purview adds protection, audit, risk, and compliance on top. Purview's Data Map can also [scan a Fabric tenant, Power BI included](https://learn.microsoft.com/en-us/purview/register-scan-fabric-tenant), to pull [item metadata](https://atlan.com/know/ai-agent/data-for-ai/metadata-management-for-ai/) and lineage into the [Purview Unified Catalog](https://atlan.com/know/ai-agent/microsoft/purview-unified-catalog/). ### Map Your Purview and Fabric Coverage Give it every system in your estate and which catalog governs each today. It returns a coverage table and the specific gap ranked by what breaks first. [Read the skill](/skills/catalog-coverage-gap-map.md). *Paste into a new chat* ``` Use the skill at https://atlan.com/skills/catalog-coverage-gap-map.md to map catalog coverage across our Purview and Fabric estate. Ask me for whatever it needs. ``` *Run once in a terminal* ``` curl -fsSL --create-dirs \ -o ~/.agents/skills/catalog-coverage-gap-map/SKILL.md \ https://atlan.com/skills/catalog-coverage-gap-map.md ``` *For an agent* ``` curl -fsSL https://atlan.com/skills/catalog-coverage-gap-map.md ``` Human Agent ClaudeChatGPTGeminiCursorOther Copy --- ## What does Purview add to Fabric's built-in governance? Fabric already ships its own governance. The [OneLake catalog](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric) covers discovery, governance insights, recommended actions, [domains](https://atlan.com/know/data-governance/how-to-scale-data-governance-across-business-domains/), endorsement, and [lineage](https://atlan.com/know/ai-agent/data-for-ai/data-lineage-for-ai/), all inside Fabric. [Microsoft's own guidance](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric) is that Purview comes in when "security, risk, and compliance needs extend beyond Fabric," and that using it "doesn't change where Fabric governance lives." So the two split the work. Fabric admins, domain admins, and [data stewards](https://atlan.com/know/ai-agent/context-layer-for-data-governance-teams/) work in the [Govern section of the OneLake catalog](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric). Purview policies, such as [protection policies](https://learn.microsoft.com/en-us/fabric/governance/protection-policies-overview), are generally configured by the security and compliance team. Here is what Purview contributes to Fabric and Power BI today, per Microsoft's documentation: | Purview capability | What it does for Fabric and Power BI | Source | |---|---|---| | Information Protection | Sensitivity labels on all Fabric items; labels and their protection travel through supported export paths | [Information protection in Fabric](https://learn.microsoft.com/en-us/fabric/governance/information-protection) | | Data Loss Prevention | Policies inspect semantic models, lakehouses, warehouses, and databases, then add tips, alerts, or access restrictions | [DLP for Fabric and Power BI](https://learn.microsoft.com/en-us/purview/dlp-powerbi-get-started) | | Audit | All Fabric user activities are logged in the Purview audit log | [Purview with Fabric](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric) | | Insider Risk Management | Ready-made risk indicators for Power BI and lakehouse activity | [Purview with Fabric](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric) | | Copilot and agent controls | Audit, eDiscovery, and retention for Copilot prompts and responses | [Purview for Copilot in Fabric](https://learn.microsoft.com/en-us/purview/ai-copilot-fabric) | | Data Map | Scans Fabric and Power BI items for metadata and lineage | [Connect to a Fabric tenant](https://learn.microsoft.com/en-us/purview/register-scan-fabric-tenant) | If the question is how Fabric and Power BI differ as products, rather than how they are governed, [this comparison of Microsoft Fabric and Power BI](https://atlan.com/microsoft-fabric-vs-power-bi/) covers architecture and use cases. --- ## How do Purview sensitivity labels protect Fabric and Power BI items? Labels come from Purview Information Protection. A user needs an [Information Protection license, plus Power BI Pro or Premium Per User, to label Power BI items](https://learn.microsoft.com/en-us/fabric/governance/information-protection). [Support differs by item type](https://learn.microsoft.com/en-us/fabric/governance/information-protection), and the gaps matter when you [plan coverage](https://atlan.com/know/ai-agent/microsoft/purview-data-governance-coverage/): - Manual and programmatic labeling work on all Fabric items. - Mandatory labeling is fully supported for Power BI items only. - Inheritance from a labeled data source works for [Power BI semantic models](https://atlan.com/know/ai-agent/semantic-layer/power-bi-semantic-model/) only. - Downstream inheritance runs Fabric to Fabric, Fabric to Power BI, and Power BI to Power BI. It does not run from a Power BI item to a Fabric item. A label stays on the content when it leaves through a [supported export path](https://learn.microsoft.com/en-us/fabric/governance/information-protection): Excel, PDF, PowerPoint, Analyze in Excel, and a .pbix download. Export to .csv or .txt is outside that list, and so is access from another tenant through external data sharing. [Protection policies](https://learn.microsoft.com/en-us/fabric/governance/protection-policies-overview) turn a label into [access control](https://atlan.com/know/ai-agent/context-layer/context-layer-role-based-access-control/). Each policy is tied to one label. Users and groups named in the policy keep the permissions they already hold, and everyone else is blocked. The [documented limits](https://learn.microsoft.com/en-us/fabric/governance/protection-policies-overview) are specific: - Up to 50 protection policies, each with up to 100 users and groups. - No support for guest or external users. - Up to 24 hours before a new policy starts protecting labeled items. - Power BI semantic models are covered; reports and dashboards are not currently supported. Protection policies need a [Microsoft 365 E3 or E5 license](https://learn.microsoft.com/en-us/fabric/governance/protection-policies-overview) and a label scoped to "Files & other data assets" with "Control access" turned on. --- ## How do Purview DLP policies work on Fabric and Power BI data? A DLP policy is defined in the Purview portal. Its conditions are [sensitivity labels and a subset of sensitive info types](https://learn.microsoft.com/en-us/purview/dlp-powerbi-get-started), and its actions fire when an item matches. [Evaluation timing](https://learn.microsoft.com/en-us/purview/dlp-powerbi-get-started) depends on the item. A Power BI semantic model is evaluated on publish, republish, on-demand refresh, and scheduled refresh. Evaluation is skipped when a service principal starts the event or owns the model. A Fabric item, such as a [lakehouse](https://atlan.com/know/ai-agent/data-for-ai/data-lakehouse-for-ai/) or SQL database, is evaluated when its data changes. [Supported item types](https://learn.microsoft.com/en-us/purview/dlp-powerbi-get-started) today are semantic models, lakehouses, warehouses, KQL databases, mirrored databases, SQL databases, and Cosmos databases. [When a policy matches](https://learn.microsoft.com/en-us/purview/dlp-powerbi-get-started), it can: 1. Attach a policy tip to the item. 2. Raise an alert on the Purview Alerts page. 3. Email administrators and named users. 4. Restrict access to data owners or members of the organization. The doc marks this action as preview. The [documented limits](https://learn.microsoft.com/en-us/purview/dlp-powerbi-get-started) decide how much of your data estate DLP reaches: - Only workspaces on Fabric or Premium capacity are in scope. - Sample semantic models, streaming datasets, and semantic models that use DirectQuery, a live connection, or mixed storage are not supported. - Only tables stored in Delta format are scanned. - Advanced classifiers, such as exact data match and trainable classifiers, return no results in a Fabric policy. - DLP policy templates are not supported, so each Fabric policy starts as a custom policy. DLP evaluation also consumes capacity, billed under [Purview billing models](https://learn.microsoft.com/en-us/purview/purview-billing-models). Teams with many import-mode models on frequent refresh should size that cost before turning on broad policies. --- ## How does Purview audit Fabric activity and govern Copilot? [All Fabric user activities](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric) land in the Purview audit log. [Searching it](https://learn.microsoft.com/en-us/fabric/admin/track-user-activities) needs the Audit Logs role in Exchange Online. The portal search defaults to the past seven days, shown in UTC, and PowerShell gives scripted access. For Insider Risk Management, Microsoft's [September 2025 announcement](https://www.microsoft.com/en-us/security/blog/2025/09/16/microsoft-purview-innovations-for-your-fabric-data-unify-data-security-and-governance-for-the-ai-era/) listed Power BI indicators for viewing, downloading, exporting, and managing sensitivity labels, which feed data theft and data leak policies. [Copilot coverage](https://atlan.com/know/microsoft-fabric/fabric-ai-agent-governance-questions/) is narrower than the data coverage. The [first Copilot in Fabric that Purview supports is Copilot for Power BI](https://learn.microsoft.com/en-us/purview/ai-copilot-fabric), across all prompts and text responses. [Support for other Copilot experiences and for Fabric data agents](https://learn.microsoft.com/en-us/purview/ai-copilot-fabric) is in preview. For these [AI interactions](https://atlan.com/know/microsoft-fabric/purview-controls-for-ai-agents/), Purview supports: - Data Security Posture Management and [DSPM for AI](https://atlan.com/know/ai-security/) - Auditing and [data classification](https://atlan.com/know/ai-agent/ai-agent-governance/data-governance-taxonomy/) - Insider Risk Management and communication compliance - eDiscovery, Data Lifecycle Management, and Compliance Manager Sensitivity labels and DLP are [listed as not supported](https://learn.microsoft.com/en-us/purview/ai-copilot-fabric) for those AI interactions. [Two settings](https://learn.microsoft.com/en-us/purview/ai-copilot-fabric) gate all of this: the Fabric tenant setting "Allow Microsoft Purview to secure AI interactions," which is on by default, and pay-as-you-go Purview billing. Retention of Copilot prompts and responses uses a retention policy on the "Microsoft Copilot Experiences" location. --- ## Can Purview catalog and trace lineage across Fabric and Power BI? Yes, within documented bounds. Purview's Data Map [registers a Fabric tenant](https://learn.microsoft.com/en-us/purview/register-scan-fabric-tenant) and runs full, incremental, or scoped scans. Scanned items include lakehouses, warehouses, notebooks, pipelines, KQL databases, and Power BI dashboards, reports, semantic models, dataflows, and paginated reports. [Depth varies by item](https://learn.microsoft.com/en-us/purview/register-scan-fabric-tenant): - For Fabric items other than Power BI, only [item-level metadata](https://atlan.com/know/ai-agent/data-for-ai/types-of-metadata-for-ai-agents/) and lineage are scanned. - Lakehouse tables and files get sub-item metadata, but not sub-item lineage. - Fabric DAX expressions are not part of metadata scanning. - Fabric tenants with tenant-level or workspace-level private links are not supported. For Power BI, Purview [captures lineage among artifacts](https://learn.microsoft.com/en-us/purview/data-map-lineage-power-bi), such as [dataflow to dataset to report to dashboard](https://atlan.com/know/data-catalog/microsoft/fabric-lineage-proof-of-value/). [Lineage from Power BI to external sources](https://learn.microsoft.com/en-us/purview/data-map-lineage-power-bi) is supported for Azure SQL Database, Azure Blob Storage, and Azure Data Lake Storage Gen1 and Gen2. [Column-level lineage and transformations](https://atlan.com/know/ai-agent/data-for-ai/automated-sql-lineage-vs-manual-lineage-mapping/) are supported when the source is Azure SQL Database. Lineage is not captured when dynamic M query parameters pass server or database names. One permission detail is easy to miss. Once metadata reaches Purview, [Purview's permissions, not Fabric's](https://learn.microsoft.com/en-us/purview/register-scan-fabric-tenant), decide who can see it, so scan scope needs the same review as any other access grant. For a longer view of Fabric's native governance controls, see [Microsoft Fabric governance: coverage gaps to close](https://atlan.com/know/ai-agent/microsoft/microsoft-fabric-governance/), and for column-level tracing into reports, [Power BI column-level lineage](https://atlan.com/know/data-catalog/microsoft/power-bi-column-level-lineage/). --- ## How does Atlan work with Fabric and Power BI metadata? When a [Power BI semantic model](https://atlan.com/know/ai-agent/semantic-layer/power-bi-semantic-model-vs-dedicated-semantic-layer/) reads from [Snowflake](https://atlan.com/know/context-layer-for-snowflake/), Databricks, or [BigQuery](https://atlan.com/know/ai-agent/gcp/google-knowledge-catalog-vs-neutral-catalog-bigquery/), the lineage a team needs [starts outside Microsoft](https://atlan.com/know/ai-agent/context-layer/multi-cloud-context-layer/). Atlan's [Power BI connector](https://docs.atlan.com/apps/connectors/business-intelligence/microsoft-power-bi/references/what-does-atlan-crawl-from-microsoft-power-bi) catalogs workspaces, datasets, tables, columns, measures with their expressions, reports, pages, and dashboards. Its [lineage extraction](https://docs.atlan.com/apps/connectors/business-intelligence/microsoft-power-bi/references/what-lineage-does-atlan-extract-from-microsoft-power-bi) parses each table's Power Query M expression to trace lineage from upstream sources including Snowflake, Databricks, Google BigQuery, Microsoft SQL Server, and [Azure Synapse](https://atlan.com/know/ai-agent/microsoft/synapse-to-fabric-migration-metadata/). On the Fabric side, Atlan [traces column-level lineage](https://docs.atlan.com/apps/connectors/business-intelligence/microsoft-fabric/references/what-lineage-does-atlan-extract-from-microsoft-fabric) from lakehouse and warehouse columns to semantic model columns and measures, and on to report visuals when Scanner API access is off. At [FabCon Europe](https://atlan.com/know/microsoft-fabric/fabcon-europe-2026-guide/), Microsoft [named Atlan one of four launch partners for Fabric Platform Lineage](https://atlan.com/live-demo-series-atlan-microsoft-fabric-2026/). Aliaxis runs Snowflake, Azure Data Factory, [dbt](https://atlan.com/know/mcp/mcp-server-for-dbt/), and Power BI. With [column-level lineage](https://atlan.com/know/ai-readiness/ai-ready-data-lineage/) in Atlan, the team [reduced time spent on root cause and impact analysis by as much as 95%](https://atlan.com/customers/aliaxis-worldwide-glossary/). Nestor Jarquin, Global Data & Analytics Lead, said finding the source of a column once took at least an hour: "With Atlan, it's a matter of minutes." --- ## FAQs about Purview for Fabric and Power BI governance ### Do I need Purview to govern Microsoft Fabric? Not for the basics. Fabric's OneLake catalog handles discovery, domains, endorsement, lineage, and governance insights on its own. Microsoft positions Purview for needs that extend beyond Fabric: classifying and protecting sensitive data, preventing risky sharing, auditing user activity, and meeting broader compliance and risk requirements. Using Purview leaves the OneLake catalog as the primary place to govern Fabric data. ### Which licenses do Purview controls for Fabric and Power BI need? Sensitivity labels need a Purview Information Protection license, and labeling Power BI items also needs Power BI Pro or Premium Per User. Protection policies need Microsoft 365 E3 or E5. Copilot governance needs pay-as-you-go Purview billing, and DLP evaluation consumes metered capacity. Confirm current terms against Microsoft's licensing guidance before you plan a rollout. ### Do Purview DLP policies work on DirectQuery semantic models? No. Microsoft's DLP documentation excludes semantic models that use DirectQuery, a live connection, or mixed storage, along with sample models and streaming datasets. DLP for Fabric also scans only tables stored in Delta format. Import-mode semantic models are evaluated on publish, republish, and each refresh, unless a service principal starts the event or owns the model. ### Does Purview capture column-level lineage for Power BI? Partly. Purview captures column-level lineage and transformations inside Power BI datasets when the source is Azure SQL Database. Other sources are not currently supported for column-level lineage. Lineage to external sources at the asset level covers Azure SQL Database, Azure Blob Storage, and Azure Data Lake Storage Gen1 and Gen2. ### Do sensitivity labels apply to Copilot for Power BI conversations? Not today. Microsoft's Purview support table for Copilot in Fabric lists sensitivity labels and DLP as not supported for AI interactions. Auditing, data classification, insider risk, communication compliance, eDiscovery, and retention are supported. Copilot for Power BI is covered for all prompts and text responses, while other Fabric Copilots and data agents are in preview. --- ## Sources 1. [Use Microsoft Purview with Microsoft Fabric, Microsoft Learn](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric) 2. [Connect to your Microsoft Fabric tenant in same tenant as Microsoft Purview, Microsoft Learn](https://learn.microsoft.com/en-us/purview/register-scan-fabric-tenant) 3. [Protection policies in Microsoft Fabric, Microsoft Learn](https://learn.microsoft.com/en-us/fabric/governance/protection-policies-overview) 4. [Information protection in Fabric, Microsoft Learn](https://learn.microsoft.com/en-us/fabric/governance/information-protection) 5. [Get started with DLP for Fabric and Power BI, Microsoft Learn](https://learn.microsoft.com/en-us/purview/dlp-powerbi-get-started) 6. [Use Microsoft Purview to manage data security and compliance for Copilot in Fabric, Microsoft Learn](https://learn.microsoft.com/en-us/purview/ai-copilot-fabric) 7. [Learn about Microsoft Purview billing models, Microsoft Learn](https://learn.microsoft.com/en-us/purview/purview-billing-models) 8. [Track user activities in Microsoft Fabric, Microsoft Learn](https://learn.microsoft.com/en-us/fabric/admin/track-user-activities) 9. [Unifying Data Security and Governance for the AI Era: Microsoft Purview Innovations for Your Fabric Data, Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/09/16/microsoft-purview-innovations-for-your-fabric-data-unify-data-security-and-governance-for-the-ai-era/) 10. [Metadata and lineage from Power BI into Microsoft Purview, Microsoft Learn](https://learn.microsoft.com/en-us/purview/data-map-lineage-power-bi)