Power BI Governance & Managed Services

Frequently asked questions about Power BI governance

• What is Power BI governance?

  Power BI governance covers all the guardrails an organization needs to run Power BI and Microsoft Fabric safely: tenant settings in the Fabric admin portal, a clear workspace strategy (Dev/Test/Prod), certified semantic models, row-level security (RLS), sensitivity labels, plus monitoring and auditing. At its core it is about controlling who can do what, with which data, in which workspace – so reports stay trustworthy and sensitive data stays protected.

• How do Power BI governance and Power Platform governance relate?

  Power BI is part of the Microsoft ecosystem around the Power Platform but is administered separately through the Fabric admin portal. The Power Platform's environment strategy and DLP policies only partially cover Power BI – workspaces, semantic models, RLS and sharing need their own guardrails. Both governance layers complement each other; we offer them individually or combined – see Power Apps Governance & Managed Services.

• What are tenant settings and why do they matter so much?

  The 100+ tenant settings in the Fabric / Power BI admin portal are the master switches of your environment: export, external sharing, publish to web, workspace creation, APIs and Copilot. We establish a documented baseline and control each setting through dedicated security groups instead of org-wide switches – so changes stay pilotable and auditable.

• What is row-level security (RLS)?

  Row-level security restricts which data rows a person sees within a shared semantic model – for example only the projects of their own department. Roles and filters are defined in the model and assigned via Microsoft Entra groups. Important: anyone with edit rights in the workspace bypasses RLS – which is why consumers belong in the app, not in the workspace.

• Why certified semantic models?

  When every report imports its own data, you get contradicting KPIs and high maintenance effort. A few certified, reusable semantic models as a single source of truth – with many thin reports connected live – make numbers consistent and trustworthy. Who may certify is deliberately restricted.

• Which licenses do we need – Pro, PPU or Fabric capacity?

  Power BI Pro is enough to publish and share – but then every viewer needs Pro as well. Premium Per User (PPU) adds large models, XMLA endpoints, deployment pipelines and Git integration. Fabric / Premium capacity (F64/P1 and above) pays off for broad distribution to Free users and for Fabric items such as lakehouses or warehouses. In the assessment we determine which combination is most economical for you.

• How do we govern Copilot in Power BI and Fabric?

  Copilot is only as good as the data underneath it. We enable Copilot selectively via security groups, restrict it to approved or certified content and pilot it with a defined user group – creating value without uncontrolled data access.

• Does governance also apply to reports from third-party solutions such as Altus PPM and Projectum xPM?

  Yes. The Power BI reports and semantic models of professional PPM solutions such as Altus PPM and Projectum xPM also run in your workspaces and belong in the inventory, workspace strategy, RLS and deployment processes. On request we operate and update them as part of the managed service.

• Does our data stay in Europe?

  Yes. Governance and managed service run entirely within your own Microsoft 365 environment. Data residency remains in your Microsoft region (for the DACH region e.g. Frankfurt, Berlin, Vienna, Zurich, Geneva).

• Does Holert also offer ongoing operations?

  Yes. As a specialized boutique consultancy and Microsoft partner we take over day-to-day operations as a managed service on request: monitoring, support, updates and reporting per SLA – including regular optimization recommendations.