Maintain a Data Analytics Solution · Topic 3 of 5
Sensitivity Labels and Endorsement
Apply Microsoft Purview sensitivity labels to Fabric items, label inheritance and export, plus endorsing items as Promoted, Certified or Master data.
- 5 min
- Sensitivity labels come from Microsoft Purview Information Protection and must be enabled in Fabric tenant settings.
- Labels can be inherited downstream and by new content built on a labelled item.
- Exported Excel, PowerPoint and PDF files keep the label and its protection.
What it is
A sensitivity label says how confidential an item is, for example General, Confidential or Highly Confidential. The labels come from Microsoft Purview Information Protection, the same labels used in Outlook, Word and Excel.
Endorsement says how trustworthy an item is. Fabric has three badges: Promoted, Certified and Master data. Labels protect; endorsement helps people find the right item.
How it works
Turning labels on
Labels are created and published in the Microsoft Purview portal. A Fabric administrator then enables sensitivity labels in the tenant settings, optionally for specific security groups only.
A user can apply a label only if the label is published to them in a Purview label policy and they have edit rights on the item. Labels appear in the item's header and in its settings.
Applying and inheriting labels
| Behaviour | What happens |
|---|---|
| Manual labelling | A user with edit rights picks a label in the item's settings or header |
| Default label policy | New items get a default label automatically |
| Mandatory label policy | Users must choose a label before they can save an item |
| Downstream inheritance | A label on a semantic model can flow to the reports and dashboards built on it |
| New content inheritance | A report created from a labelled semantic model starts with that label |
| Export | Exporting to Excel, PowerPoint or PDF writes the label into the file, with any encryption it defines |
The export behaviour is the main protection a label adds. A file that leaves Fabric stays marked, and an encrypting label still controls who can open it.
A label on its own does not change Fabric permissions. Who can open the item in the service is still decided by workspace roles and item permissions.
Endorsement badges
| Badge | Who can apply it | Meaning |
|---|---|---|
| Promoted | Any user with write permission on the item | "This is ready to share and worth using" |
| Certified | Only users that the Fabric administrator authorizes | Reviewed against the organization's quality standards |
| Master data | Only users that the Fabric administrator authorizes | The authoritative source for core data such as customers or products |
An item carries one badge at a time. Certification and Master data are enabled in tenant settings, where the administrator lists the groups allowed to apply them and can add a documentation link that explains the process.
Master data is meant for data items, such as lakehouses, warehouses and semantic models, rather than reports.
Where endorsement helps
Endorsed items are easier to find. The OneLake catalog lets users filter by endorsement, and endorsed items show their badge when people pick data in Power BI Desktop or in a Fabric item.
Certification is also how you steer self-service users towards one shared semantic model instead of many copies.
A worked example
The central BI team publishes a sales semantic model built on a warehouse. The data includes customer names and margins.
- The team owner applies the Confidential label to the warehouse and the semantic model.
- A member of the authorized certification group reviews the model and marks it Certified.
- A regional analyst finds the model in the OneLake catalog by filtering on Certified items, and builds a report. The new report starts with the Confidential label.
- A manager exports a visual to Excel. The Excel file is labelled Confidential and keeps the label's protection.
If a question asks who can certify, the answer is never "any Member". Only people the Fabric administrator authorizes in the tenant settings can certify.
How the exam asks about this
- "Exported files must keep the organization's classification." Apply a sensitivity label; it is written into exported Excel, PowerPoint and PDF files.
- "Users must find the official, reviewed semantic model." Certify it.
- "Every new item must have a label before it is saved." A mandatory label policy.
What to remember for the exam
- Sensitivity labels come from Microsoft Purview Information Protection and must be enabled in Fabric tenant settings.
- Labels can be inherited downstream and by new content built on a labelled item.
- Exported Excel, PowerPoint and PDF files keep the label and its protection.
- Promoted: anyone with write permission. Certified and Master data: only authorized users.
- One endorsement badge per item; endorsed items stand out in the OneLake catalog.
A sensitivity label does not replace permissions. A Confidential report is still visible to everyone who has access to it; control access with roles, item permissions and data security.
Common mistakes
Expecting a label to block access in the workspace. Labels classify and protect exported files. Use workspace roles and item permissions to decide who opens the item.
Letting the item owner certify their own content. Ownership is enough to promote, not to certify. Certification needs membership of the group the administrator authorized.
Marking reports as Master data. Master data is for authoritative data items such as a customer lakehouse or a product semantic model. A report is promoted or certified instead.
Check yourself
Which endorsement badge can any user with write permission apply?
Promoted. Certified and Master data need users authorized by the Fabric administrator.
What happens to a sensitivity label when a user exports a labelled report to PDF?
The PDF carries the same label and any protection, such as encryption, that the label defines.
Where are sensitivity labels defined before they can be used in Fabric?
In Microsoft Purview Information Protection, then published to users in a label policy and enabled in the Fabric tenant settings.
Topic 3 of 5 in Maintain a Data Analytics Solution
Test yourself on Maintain a Data Analytics Solution
The full Microsoft DP-600 question bank has 648 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.