Microsoft Purview governs Microsoft Fabric and Power BI with sensitivity labels, data loss prevention (DLP) policies, the audit log, insider risk indicators, and controls for Copilot. The OneLake catalog stays the main place to discover, endorse, and trace Fabric data, and Purview adds protection, audit, risk, and compliance on top. Purview’s Data Map can also scan a Fabric tenant, Power BI included, to pull item metadata and lineage into the Purview Unified Catalog.
What does Purview add to Fabric’s built-in governance?
Fabric already ships its own governance. The OneLake catalog covers discovery, governance insights, recommended actions, domains, endorsement, and lineage, all inside Fabric. Microsoft’s own guidance is that Purview comes in when “security, risk, and compliance needs extend beyond Fabric,” and that using it “doesn’t change where Fabric governance lives.”
So the two split the work. Fabric admins, domain admins, and data stewards work in the Govern section of the OneLake catalog. Purview policies, such as protection policies, are generally configured by the security and compliance team. Here is what Purview contributes to Fabric and Power BI today, per Microsoft’s documentation:
| Purview capability | What it does for Fabric and Power BI | Source |
|---|---|---|
| Information Protection | Sensitivity labels on all Fabric items; labels and their protection travel through supported export paths | Information protection in Fabric |
| Data Loss Prevention | Policies inspect semantic models, lakehouses, warehouses, and databases, then add tips, alerts, or access restrictions | DLP for Fabric and Power BI |
| Audit | All Fabric user activities are logged in the Purview audit log | Purview with Fabric |
| Insider Risk Management | Ready-made risk indicators for Power BI and lakehouse activity | Purview with Fabric |
| Copilot and agent controls | Audit, eDiscovery, and retention for Copilot prompts and responses | Purview for Copilot in Fabric |
| Data Map | Scans Fabric and Power BI items for metadata and lineage | Connect to a Fabric tenant |
If the question is how Fabric and Power BI differ as products, rather than how they are governed, this comparison of Microsoft Fabric and Power BI covers architecture and use cases.
How do Purview sensitivity labels protect Fabric and Power BI items?
Labels come from Purview Information Protection. A user needs an Information Protection license, plus Power BI Pro or Premium Per User, to label Power BI items. Support differs by item type, and the gaps matter when you plan coverage:
- Manual and programmatic labeling work on all Fabric items.
- Mandatory labeling is fully supported for Power BI items only.
- Inheritance from a labeled data source works for Power BI semantic models only.
- Downstream inheritance runs Fabric to Fabric, Fabric to Power BI, and Power BI to Power BI. It does not run from a Power BI item to a Fabric item.
A label stays on the content when it leaves through a supported export path: Excel, PDF, PowerPoint, Analyze in Excel, and a .pbix download. Export to .csv or .txt is outside that list, and so is access from another tenant through external data sharing.
Protection policies turn a label into access control. Each policy is tied to one label. Users and groups named in the policy keep the permissions they already hold, and everyone else is blocked. The documented limits are specific:
- Up to 50 protection policies, each with up to 100 users and groups.
- No support for guest or external users.
- Up to 24 hours before a new policy starts protecting labeled items.
- Power BI semantic models are covered; reports and dashboards are not currently supported.
Protection policies need a Microsoft 365 E3 or E5 license and a label scoped to “Files & other data assets” with “Control access” turned on.
How do Purview DLP policies work on Fabric and Power BI data?
A DLP policy is defined in the Purview portal. Its conditions are sensitivity labels and a subset of sensitive info types, and its actions fire when an item matches.
Evaluation timing depends on the item. A Power BI semantic model is evaluated on publish, republish, on-demand refresh, and scheduled refresh. Evaluation is skipped when a service principal starts the event or owns the model. A Fabric item, such as a lakehouse or SQL database, is evaluated when its data changes.
Supported item types today are semantic models, lakehouses, warehouses, KQL databases, mirrored databases, SQL databases, and Cosmos databases. When a policy matches, it can:
- Attach a policy tip to the item.
- Raise an alert on the Purview Alerts page.
- Email administrators and named users.
- Restrict access to data owners or members of the organization. The doc marks this action as preview.
The documented limits decide how much of your data estate DLP reaches:
- Only workspaces on Fabric or Premium capacity are in scope.
- Sample semantic models, streaming datasets, and semantic models that use DirectQuery, a live connection, or mixed storage are not supported.
- Only tables stored in Delta format are scanned.
- Advanced classifiers, such as exact data match and trainable classifiers, return no results in a Fabric policy.
- DLP policy templates are not supported, so each Fabric policy starts as a custom policy.
DLP evaluation also consumes capacity, billed under Purview billing models. Teams with many import-mode models on frequent refresh should size that cost before turning on broad policies.
How does Purview audit Fabric activity and govern Copilot?
All Fabric user activities land in the Purview audit log. Searching it needs the Audit Logs role in Exchange Online. The portal search defaults to the past seven days, shown in UTC, and PowerShell gives scripted access.
For Insider Risk Management, Microsoft’s September 2025 announcement listed Power BI indicators for viewing, downloading, exporting, and managing sensitivity labels, which feed data theft and data leak policies.
Copilot coverage is narrower than the data coverage. The first Copilot in Fabric that Purview supports is Copilot for Power BI, across all prompts and text responses. Support for other Copilot experiences and for Fabric data agents is in preview. For these AI interactions, Purview supports:
- Data Security Posture Management and DSPM for AI
- Auditing and data classification
- Insider Risk Management and communication compliance
- eDiscovery, Data Lifecycle Management, and Compliance Manager
Sensitivity labels and DLP are listed as not supported for those AI interactions. Two settings gate all of this: the Fabric tenant setting “Allow Microsoft Purview to secure AI interactions,” which is on by default, and pay-as-you-go Purview billing. Retention of Copilot prompts and responses uses a retention policy on the “Microsoft Copilot Experiences” location.
Can Purview catalog and trace lineage across Fabric and Power BI?
Yes, within documented bounds. Purview’s Data Map registers a Fabric tenant and runs full, incremental, or scoped scans. Scanned items include lakehouses, warehouses, notebooks, pipelines, KQL databases, and Power BI dashboards, reports, semantic models, dataflows, and paginated reports.
- For Fabric items other than Power BI, only item-level metadata and lineage are scanned.
- Lakehouse tables and files get sub-item metadata, but not sub-item lineage.
- Fabric DAX expressions are not part of metadata scanning.
- Fabric tenants with tenant-level or workspace-level private links are not supported.
For Power BI, Purview captures lineage among artifacts, such as dataflow to dataset to report to dashboard. Lineage from Power BI to external sources is supported for Azure SQL Database, Azure Blob Storage, and Azure Data Lake Storage Gen1 and Gen2. Column-level lineage and transformations are supported when the source is Azure SQL Database. Lineage is not captured when dynamic M query parameters pass server or database names.
One permission detail is easy to miss. Once metadata reaches Purview, Purview’s permissions, not Fabric’s, decide who can see it, so scan scope needs the same review as any other access grant. For a longer view of Fabric’s native governance controls, see Microsoft Fabric governance: coverage gaps to close, and for column-level tracing into reports, Power BI column-level lineage.
How does Atlan work with Fabric and Power BI metadata?
When a Power BI semantic model reads from Snowflake, Databricks, or BigQuery, the lineage a team needs starts outside Microsoft. Atlan’s Power BI connector catalogs workspaces, datasets, tables, columns, measures with their expressions, reports, pages, and dashboards. Its lineage extraction parses each table’s Power Query M expression to trace lineage from upstream sources including Snowflake, Databricks, Google BigQuery, Microsoft SQL Server, and Azure Synapse.
On the Fabric side, Atlan traces column-level lineage from lakehouse and warehouse columns to semantic model columns and measures, and on to report visuals when Scanner API access is off. At FabCon Europe, Microsoft named Atlan one of four launch partners for Fabric Platform Lineage.
Aliaxis runs Snowflake, Azure Data Factory, dbt, and Power BI. With column-level lineage in Atlan, the team reduced time spent on root cause and impact analysis by as much as 95%. Nestor Jarquin, Global Data & Analytics Lead, said finding the source of a column once took at least an hour: “With Atlan, it’s a matter of minutes.”
FAQs about Purview for Fabric and Power BI governance
Do I need Purview to govern Microsoft Fabric?
Not for the basics. Fabric’s OneLake catalog handles discovery, domains, endorsement, lineage, and governance insights on its own. Microsoft positions Purview for needs that extend beyond Fabric: classifying and protecting sensitive data, preventing risky sharing, auditing user activity, and meeting broader compliance and risk requirements. Using Purview leaves the OneLake catalog as the primary place to govern Fabric data.
Which licenses do Purview controls for Fabric and Power BI need?
Sensitivity labels need a Purview Information Protection license, and labeling Power BI items also needs Power BI Pro or Premium Per User. Protection policies need Microsoft 365 E3 or E5. Copilot governance needs pay-as-you-go Purview billing, and DLP evaluation consumes metered capacity. Confirm current terms against Microsoft’s licensing guidance before you plan a rollout.
Do Purview DLP policies work on DirectQuery semantic models?
No. Microsoft’s DLP documentation excludes semantic models that use DirectQuery, a live connection, or mixed storage, along with sample models and streaming datasets. DLP for Fabric also scans only tables stored in Delta format. Import-mode semantic models are evaluated on publish, republish, and each refresh, unless a service principal starts the event or owns the model.
Does Purview capture column-level lineage for Power BI?
Partly. Purview captures column-level lineage and transformations inside Power BI datasets when the source is Azure SQL Database. Other sources are not currently supported for column-level lineage. Lineage to external sources at the asset level covers Azure SQL Database, Azure Blob Storage, and Azure Data Lake Storage Gen1 and Gen2.
Do sensitivity labels apply to Copilot for Power BI conversations?
Not today. Microsoft’s Purview support table for Copilot in Fabric lists sensitivity labels and DLP as not supported for AI interactions. Auditing, data classification, insider risk, communication compliance, eDiscovery, and retention are supported. Copilot for Power BI is covered for all prompts and text responses, while other Fabric Copilots and data agents are in preview.
Sources
- Use Microsoft Purview with Microsoft Fabric, Microsoft Learn
- Connect to your Microsoft Fabric tenant in same tenant as Microsoft Purview, Microsoft Learn
- Protection policies in Microsoft Fabric, Microsoft Learn
- Information protection in Fabric, Microsoft Learn
- Get started with DLP for Fabric and Power BI, Microsoft Learn
- Use Microsoft Purview to manage data security and compliance for Copilot in Fabric, Microsoft Learn
- Learn about Microsoft Purview billing models, Microsoft Learn
- Track user activities in Microsoft Fabric, Microsoft Learn
- Unifying Data Security and Governance for the AI Era: Microsoft Purview Innovations for Your Fabric Data, Microsoft Security Blog
- Metadata and lineage from Power BI into Microsoft Purview, Microsoft Learn
