Day 27: Power BI Governance & Security

RLS restricts data rows visible to specific users based on their identity. Static RLS: pre-defined roles with fixed filter rules. Create in Desktop: Modelling → Manage Roles → New Role → enter a DAX filter on a table (e.g. [Region] = "North"). Publish to Service → dataset Security → add users/groups to that role. Dynamic RLS: the filter uses USERPRINCIPALNAME() to match the logged-in user against data in a mapping table. Example: [ManagerEmail] = USERPRINCIPALNAME(). Dynamic RLS scales to many users without creating many roles — one role handles all users through the mapping table.

The Power BI Admin Portal (accessible to Power BI administrators at app.powerbi.com → Settings → Admin Portal) is where organisation-wide Power BI settings are managed: enabling/disabling features (export to Excel, publish to web, R/Python visuals, custom visuals), managing users and licences, monitoring usage metrics across the organisation, setting sharing policies (can users share externally?), configuring certified datasets and endorsed content, and reviewing audit logs. As a data analyst, you interact with Admin Portal settings through your IT/Power BI admin — but knowing these settings exist helps explain why certain features may be disabled.

Endorsement marks a dataset as authoritative and trustworthy so other report builders know which datasets to use. Two levels: Promoted (any dataset owner can promote their own dataset — signals it is ready for wider use), Certified (only Power BI admins or designated certifiers can certify — signals the dataset has been reviewed for accuracy, data governance, and follows organisational standards). Endorsed datasets appear prominently in the dataset search and have a badge. In organisations with many datasets, endorsement prevents "which dataset should I use?" confusion and reduces duplicate data model creation.

A Dataflow is a reusable Power Query transformation saved and executed in Power BI Service (not Desktop) that outputs clean, standardised tables to a common data store (Azure Data Lake Storage). Multiple datasets and reports can then connect to the same dataflow. Benefits: single source of truth for transformations (change the cleaning logic once, all downstream datasets update), the ETL runs in the cloud (not on a local Desktop), and large transformations are offloaded to Azure infrastructure. A Dataset includes both the data model (relationships, measures) and the data. A Dataflow is only the ETL layer — no relationships or DAX.

Deployment Pipelines (Power BI Premium) provide a structured Dev → Test → Production workflow for Power BI content. Each stage is a workspace. When content is ready, it is promoted from Dev to Test (for QA) and then to Production (for end users) with a single click. The pipeline tracks differences between stages and lets you compare content before promoting. Benefits: developers work in Dev without affecting Production, changes go through review before reaching users, and rollback is possible by promoting the previous version back. This is the Power BI equivalent of a software deployment pipeline — important for large organisations with multiple report developers.