Prepstellar
Get the app

DP-600 · Analytics Security and Governance

19 cards

Sensitivity Labels and Endorsement

Swipe, scroll or use ← →

  1. Classify an item with a sensitivity label

    Governance answers two separate questions about the same item: how sensitive is this and can I trust it. Labels answer the first.

    Sensitivity labels are metadata tags from Microsoft Purview Information Protection that classify Fabric items according to levels defined by the organization. A label appears on the item in the Fabric portal and can enforce access through a Microsoft Purview protection policy.

    Sensitivity labels work across Fabric item types, including lakehouses, warehouses, semantic models, reports, notebooks, and pipelines. They require Microsoft Purview Information Protection licensing and configuration by the organization's Purview administrator.

    1 / 19

  2. Quick check

    What exactly is a sensitivity label on a Fabric item?

    1. AA badge signalling reviewed quality

      Reviewed quality is what the Certified endorsement claims, not what a sensitivity label records.

    2. BA team-level readiness signal

      Team-level readiness describes the Promoted endorsement rather than a classification.

    3. CA Microsoft Purview metadata tag that classifies the item by the organization's levels

      Right. A label is a Microsoft Purview Information Protection tag that classifies the item according to the organization's levels.

    2 / 19

  3. Follow the label out of the portal

    Labels can remain attached to data beyond the Fabric portal, which is what makes them more than decoration.

    When labeled data is exported through supported paths to Excel, PDF, PowerPoint, or Power BI Desktop files, the label and its protections travel with the exported file.

    Export Does the protection travel?
    Excel, PDF, PowerPoint, Power BI Desktop Yes
    CSV, TXT No

    CSV and TXT exports do not carry label protection, so Fabric displays a warning for those paths. The plain-text formats have nowhere to store the label, and no endorsement or setting changes that.

    3 / 19

  4. Quick check

    Data from a labeled item is exported. Which path carries the label and its protections with it?

    1. AA TXT file

      TXT does not carry label protection, and Fabric warns the user on that path.

    2. BA PowerPoint file

      Right. PowerPoint is one of the supported paths, alongside Excel, PDF, and Power BI Desktop files.

    3. CA CSV file, if the item is also promoted

      Promotion is a trust signal and does not change what a CSV export can carry.

    4 / 19

  5. Automate the labeling

    Manual labeling decays: people forget, and the unlabeled items are exactly the ones nobody reviews. Fabric can reduce manual labeling through automation.

    • Default labeling gives a new item a baseline label when none is chosen during creation.
    • Mandatory labeling can prevent users from saving Power BI items without a label, although support for non-Power BI Fabric items is limited.
    • Downstream inheritance propagates labels from upstream to downstream items, and Power BI semantic models can inherit labels from labeled data sources.
    5 / 19

  6. Automate the labeling

    The three are easy to mix up because they all end with a labeled item, but they intervene at different moments.

    Moment Capability
    The creator picks nothing Default labeling supplies the baseline
    The creator tries to save unlabeled Mandatory labeling blocks the save
    An upstream item is labeled Downstream inheritance propagates it

    When the requirement is that creation must never leave an item unclassified, default labeling supplies the baseline instead of blocking the save.

    6 / 19

  7. Quick check

    Every new item should receive a baseline classification whenever its creator chooses no label. Which capability does that?

    1. ADefault labeling

      Right. Default labeling supplies a baseline label when none is chosen during creation.

    2. BMandatory labeling, which blocks the save

      Mandatory labeling stops an unlabeled Power BI item from being saved rather than supplying the baseline itself.

    3. CDownstream inheritance along lineage

      Downstream inheritance propagates an upstream label and does not cover an item created with none.

    7 / 19

  8. Keep your progress in the app

    That’s 3 of 8 quick checks. In the app they stay answered, and every lesson remembers where you left off.

    Get the app Keep reading here

  9. Signal trust with endorsement

    The second governance question is whether an item can be trusted, and endorsement answers it. Endorsement makes trustworthy content easier to discover by displaying a badge and giving endorsed items priority in searches and sorted lists.

    That second half is the practical payoff. In a tenant with forty similar semantic models, the badge is what moves the maintained one to the top of the list. Fabric provides three endorsement levels.

    8 / 19

  10. Quick check

    What does endorsing an item change for the people looking for it?

    1. AIts sensitivity classification

      Classification is what a sensitivity label records; endorsement does not set it.

    2. BWho is allowed to open it

      Endorsement is a discovery and trust signal, not an access decision.

    3. CIt shows a badge and gives the item priority in searches and sorted lists

      Right. Endorsement displays a badge and lifts the item in searches and sorted lists, which is how it makes trustworthy content easier to find.

    9 / 19

  11. Separate Promoted from Certified

    The first two levels differ in who may apply them and how wide a claim they make.

    Promoted is a team-level signal that any user with write permission can apply to a tested item. Certified means an organization-authorized reviewer has verified that an item meets quality standards for cross-team or organization-wide use.

    Level Who applies it How far the claim reaches
    Promoted Any user with write permission The team
    Certified An organization-authorized reviewer Cross-team or organization-wide
    10 / 19

  12. Separate Promoted from Certified

    Certification is deliberately harder to obtain. A Fabric administrator defines who can certify, and certification can be delegated to domain administrators.

    So a question that mentions a formal review, an authorized reviewer, or organization-wide reuse is describing Certified, while one that mentions a tested item and a write user is describing Promoted.

    11 / 19

  13. Quick check

    A semantic model has passed formal quality review and is meant for reuse across the organization. A domain-authorized reviewer must signal that. Which endorsement applies?

    1. APromoted

      Promoted is the lower-friction team-level signal that any user with write permission can apply.

    2. BCertified

      Right. Certified is the level an organization-authorized reviewer applies for cross-team or organization-wide use.

    3. CMaster data

      Master data identifies a single source of truth for core reference data, which this scenario does not establish.

    12 / 19

  14. Reserve Master data for the source of truth

    Master data identifies a data-containing item as a single source of truth for core reference data. It is the narrowest of the three levels in both who may apply it and what it can be applied to.

    Only users specified by the Fabric administrator can apply this designation, and it applies to items that contain data, such as lakehouses and semantic models. A report that visualizes the product catalog is not the catalog; the item holding the data is.

    13 / 19

  15. Quick check

    A governed lakehouse holds the canonical product catalog and must be marked as the single source of truth. Only users the Fabric administrator names may apply the signal. Which one is it?

    1. AMaster data

      Right. Master data marks a data-containing item as the single source of truth, and only designated users can apply it.

    2. BCertified, applied by a reviewer

      Certified signals reviewed quality for broad use but does not designate a single source of truth.

    3. CPromoted, applied by any write user

      Promoted is a team-level readiness signal available to any user with write permission.

    14 / 19

  16. Know the coverage and the division of labor

    Endorsement covers almost everything, with one exception worth memorizing. Nearly all Fabric and Power BI items can be promoted or certified, but Power BI dashboards do not support endorsement.

    15 / 19

  17. Know the coverage and the division of labor

    Sensitivity labels and endorsement answer different governance questions. A sensitivity label communicates classification and may enforce protection, while endorsement communicates an item's trust and readiness for reuse.

    Question Signal
    How sensitive is this, and what may leave with it? Sensitivity label
    Can I rely on this, and who says so? Endorsement

    Neither replaces the other, and neither grants or removes access on its own.

    16 / 19

  18. Quick check

    How do sensitivity labels and endorsement divide the work?

    1. ALabels signal trust; endorsement enforces Purview protection

      This reverses both: endorsement is the trust signal, and protection follows the label.

    2. BLabels communicate classification; endorsement communicates trust and readiness

      Right. Classification and possible protection belong to the label; trust and readiness for reuse belong to endorsement.

    3. CLabels certify quality after review; endorsement decides which export formats keep protection

      Certification is an endorsement level, and export protection follows the supported sensitivity-label paths.

    17 / 19

  19. Key takeaways

    • Sensitivity labels classify items and can carry protection into supported Excel, PDF, PowerPoint, and Power BI Desktop exports.
    • Promoted is a write-user, team-level signal; Certified requires an authorized reviewer for broader use.
    • Master data is restricted to designated users and data-containing items that serve as a single source of truth.
    • Default labeling, mandatory labeling, and downstream inheritance each intervene at a different moment in an item's life.
    18 / 19

  20. Quick check

    Which summary separates the three endorsement levels correctly?

    1. APromoted is a team-level signal any write user can apply, Certified needs an authorized reviewer, and Master data is limited to designated users and data-containing items

      Right. Those are the three levels, in increasing order of who is allowed to apply them.

    2. BPromoted needs an authorized reviewer, Certified is open to any write user, and Master data is open to everyone

      Promoted and Certified are swapped here, and Master data is restricted to users the administrator specifies.

    3. CAll three are applied by the Purview administrator as part of the classification policy

      Endorsement is a Fabric trust signal, not a Purview classification decision.

    19 / 19

  21. 8 quick checks · then the test

    In the app, finishing the quick checks opens this lesson’s 10-question test, and the ones you miss come back exactly when you’re about to forget them.

    Take this lesson’s test → Next lesson: Workspace Version ControlGet the app
← Previous Keep your progress · Get the app Next card →

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app