Microsoft Viva: Ability for leaders to publish Power BI reports

🚨 The Signal: Viva Insights now allows leaders to publish Power BI reports directly. This increases data sharing velocity but expands the attack surface for sensitive organizational insights if not properly governed.

The Impact

Leaders and their delegates are affected, with the primary security risk being the unauthorized exposure or oversharing of sensitive organizational data.

• Leaders: Increased risk of inadvertently sharing sensitive data with a broader audience.
• Delegates: Potential for misuse of publishing privileges if not properly managed.
• Security Teams: New data flow to monitor for compliance and data loss prevention.
• Data Owners: Increased complexity in tracking and controlling sensitive information.

The Action

1. Review existing Power BI tenant settings for publishing and sharing permissions.
2. Implement or refine Data Loss Prevention (DLP) policies for Viva Insights and Power BI content.
3. Educate leaders and delegates on responsible data sharing practices and sensitivity labels.
4. Audit Power BI report sharing and Viva Insights content distribution regularly.
5. Ensure appropriate sensitivity labels are applied to all Power BI reports containing sensitive data.

Domain: Purview · Impact: medium · Workload: Microsoft Purview