Stop Power BI Data Leaks: Block Exports from Unmanaged Devices Using AAD Conditional Access & Sensitivity Labels

As Power BI adoption grows, so do risks of accidental or malicious data leaks. A common gap? Lack of granular control over report exports. Traditional security measures like role-based access (RBAC) or IP restrictions fail to address modern threats like:

• Employees exporting sensitive reports to personal laptops.
• Contractors accessing data from unsecured devices.
• Data exfiltration via non-compliant endpoints (e.g., outdated OS, no encryption).

Real-World Example

A European healthcare provider allowed Power BI exports from any device with AAD authentication. A contractor exported a patient analytics report to a personal laptop infected with malware. The breach led to a $500k GDPR fine and reputational damage.

Why Existing Solutions Fall Short:

• Power BI Workspace RBAC: Controls who accesses data, not how or where.
• Static IP Allow listing: Fails to account for remote/mobile workforces.
• Basic AAD Sign-In Policies: Don’t validate device health or encryption status.

Solution Steps

Goal: Enforce device compliance and location-based restrictions for Power BI exports using AAD Conditional Access and Microsoft Purview Sensitivity Labels.

1. Configure Azure AD Conditional Access Policy

Scenario: Block exports unless the device is Intune-compliant or hybrid Azure AD-joined.

• Deploy policies enforcing disk encryption, OS version, and antivirus status.
• Use Microsoft Endpoint Manager Admin Center > Devices > Compliance Policies.
• Create Conditional Access Policy:
• Conditions: Client Apps: Browser and Mobile Apps/Desktop Clients (to cover all export paths).
• Locations: Block exports from high-risk countries (optional).

1. Create a Label in Microsoft Purview:
2. Go to Microsoft Purview Compliance Portal > Solutions > Information Protection > Labels.
3. Encryption: Restrict decryption to AAD-joined devices.
4. Content Marking: Add watermarks to deter screenshots.
5. Auto-Labeling: Use regex to tag PII/PHI automatically.
6. Publish Labels to Power BI:
7. Create a labeling policy scoped to Power BI workspaces.
8. In Power BI, apply labels to datasets, reports, or entire workspaces.

• Access Controls:
• Grant: Require device to be marked as compliant + Require Hybrid Azure AD join.
• Session: Use app-enforced restrictions (for Power BI embedded scenarios).

Step-by-Step

1. Enable Intune Compliance Policies (prerequisite):
2. Case Study: A Fortune 500 retailer implemented this solution and saw:
3. 92% reduction in unauthorized exports.
4. Zero compliance penalties in 12 months.
5. 30% faster audits due to Azure Sentinel logging.
6. Lessons Learned:
7. Test in Report-Only Mode: Use AAD’s What If tool to simulate policies.
8. Combine with DLP: Use Microsoft Purview DLP to block copy-paste from Power BI.
9. Educate Users: Train teams on exporting via secure devices (e.g., Azure Virtual Desktop).

# Install AzureAD module if needed Install-Module AzureAD Connect-AzureAD $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition $conditions.Applications.IncludeApplications = "00000009-0000-0000-c000-000000000000" # Power BI $conditions.ClientAppTypes = @('Browser', 'MobileAppsAndDesktopClients') $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls $controls._Operator = "OR" $controls.BuiltInControls = @("CompliantDevice", "DomainJoinedDevice") New-AzureADMSConditionalAccessPolicy -DisplayName "Block Power BI Exports on Non-Compliant Devices" ` -State "Enabled" ` -Conditions $conditions ` -GrantControls $controls

2. Apply Sensitivity Labels with Export Restrictions

Labels add a data-centric layer to enforce encryption and block exports even if a user bypasses AAD policies (e.g., via screenshotting).

Originally published at https://yourtechjournalist.blogspot.com on April 3, 2025.