To track changes to sensitivity labels in Power BI reports and datasets, you can utilize several tools and features within the Power BI and Microsoft Purview ecosystem. These tools help you maintain audit trails, ensure compliance with data governance policies, and monitor the integrity of sensitive data. Here’s how you can track changes to sensitivity labels:
1. Microsoft Purview Audit Logs
-
Audit Logs in Microsoft Purview: One of the primary ways to track changes to sensitivity labels is through audit logging in the Microsoft Purview compliance center. Microsoft Purview captures actions related to sensitivity labels, including when a label is applied, modified, or removed from a report or dataset. The audit logs include detailed records of what changes were made, who made them, and when they occurred.
-
Setting Up Audit Logging: To enable auditing, go to the Microsoft Purview compliance portal, navigate to Audit under the Solutions section, and ensure audit logging is enabled for Power BI. This will allow you to capture events such as sensitivity label assignments or changes.
-
Review and Export Audit Logs: You can filter the audit logs by activity type (e.g., "Applied label," "Removed label," "Changed label") to track specific changes related to sensitivity labels. The audit data can be exported for further analysis or compliance reporting.
2. Power BI Activity Log (Audit Logs)
-
Power BI Service Activity Logs: Power BI itself also provides activity logs that track user actions within the Power BI service, including actions involving sensitivity labels. These logs can help you monitor changes in report properties, such as the application or modification of sensitivity labels.
-
Enabling Power BI Activity Logs: You can access these logs via the Power BI Admin Portal. Under the Tenant Settings, make sure logging is enabled to capture activities related to security, labeling, and other administrative actions. Once enabled, you can review these logs to identify changes in labels.
-
Exporting and Reviewing Logs: Power BI Admins can export activity logs and search for events related to label changes. These logs provide insights into actions performed on reports and datasets, which can be useful for tracking modifications to sensitive information.
3. Microsoft Graph Security API
-
API for Security and Compliance: If you need a more programmatic approach, you can leverage the Microsoft Graph Security API. This API allows you to track changes to labels and other security-related activities across Microsoft services, including Power BI. By integrating the API into your environment, you can create custom monitoring solutions that capture and alert you when sensitivity labels are applied, modified, or removed.
-
Custom Alerts and Notifications: The Graph API can be configured to trigger alerts when certain actions occur, such as label changes. This provides an automated way to monitor and enforce compliance policies.
4. Power BI and Microsoft 365 Compliance Center Alerts
-
Setting Up Alerts in Purview: In the Microsoft Purview compliance portal, you can set up custom alerts for when sensitivity labels are modified. These alerts can notify administrators or compliance officers when a label is changed or removed, ensuring immediate attention to potential issues.
-
Alerts for Unapproved Label Changes: Use this feature to monitor specific activities that could pose risks, such as unauthorized removal of a "Confidential" label or changes to data security settings.
5. Power BI Governance and Compliance Features
-
Data Protection Policies: Power BI offers some built-in governance features, such as Data Loss Prevention (DLP) policies, which can be used in conjunction with sensitivity labels to ensure that the right label is always applied and that any changes to the label are monitored.
-
Sensitivity Label Protection: If you configure your organization to enforce strict rules regarding sensitivity labels, you can reduce the likelihood of unauthorized changes. Sensitivity labels can be locked in Power BI to prevent users from removing or altering them without administrative permissions.
6. Microsoft PowerShell for Audit Monitoring
-
PowerShell Commands: For more advanced tracking, you can use PowerShell commands to query audit logs for Power BI and other Microsoft 365 services. PowerShell scripts can automate the extraction of audit data related to sensitivity label changes, allowing you to create custom reports or schedule regular audits.
