Microsoft Viva Insights: New Power BI report publishing capabilities for leaders

🚨 The Signal: Viva Insights now allows leaders (not just analysts) to publish Power BI reports directly. This expands who can distribute sensitive organizational insights, increasing data exposure risk if not properly governed.

The Impact

Global Admins and Insights Admins are affected, facing increased risk of sensitive data exposure through expanded report publishing.

• Global Admins: Must review and potentially restrict default publishing settings to prevent unauthorized data sharing.
• Insights Admins: Need to manage expanded publishing permissions to mitigate sensitive information leakage.
• Leaders/Delegates: Gain new publishing capabilities, increasing their responsibility for data handling and potential for inadvertent oversharing.
• Report Recipients: May receive more reports, increasing their exposure to potentially sensitive data.

The Action

1. Navigate to Microsoft Viva Feature Access Management in the Microsoft 365 admin center.
2. Locate the 'Report publish' setting (formerly 'Analyst report publish').
3. Review the default 'on' setting and consider disabling it or restricting publishing permissions based on organizational policy.
4. Implement a policy for leaders on appropriate data sharing and audience selection for Viva Insights reports.
5. Conduct an audit of existing Viva Insights report publishers and their access levels.

Domain: Other · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898