Sensitivity Labels & Endorsement

Classification and trust

Simple explanation

Sensitivity labels are like food allergen stickers — “Contains confidential data, handle with care.” They come from Microsoft Purview and travel with the data when exported.

Endorsement is like a restaurant rating: Promoted (recommended by owner) or Certified (verified by inspector).

Sensitivity labels

Label	Meaning	Restrictions
Public	Safe for external sharing	None
General	Internal use	None
Confidential	Sensitive, internal only	Encryption, no external sharing
Highly Confidential	Regulated data	Encryption, watermarks, restricted access

Labels inherit downstream — a labelled semantic model passes its label to reports built on it. Labels persist in exports (PDF, Excel).

Endorsement

Promoted = team-level. Certified = org-level.
Feature	Promoted	Certified
Who can apply	Workspace Members, Admins	Only designated certifiers (configured by Fabric admin)
Trust level	Team recommendation	Organisational verification

Question

Where do Fabric sensitivity labels come from?

Click or press Enter to reveal answer

Answer

Microsoft Purview Information Protection. They persist when data is exported and can enforce encryption.

Click to flip back

Question

Promoted vs Certified endorsement?

Click or press Enter to reveal answer

Answer

Promoted: any workspace Member can apply (team recommendation). Certified: requires special permissions from Fabric admin (org-wide verification).

Click to flip back

Knowledge Check

Raj wants all new Fabric items in the finance workspace to be classified. What should the admin configure?

Question

How do sensitivity labels inherit downstream in Fabric?

Click or press Enter to reveal answer

Answer

When a labelled semantic model is used to create a report, the report automatically inherits the model's sensitivity label. Labels also persist in exports (PDF, Excel, PowerPoint). This ensures downstream items are never less protected than their source.

Click to flip back

Knowledge Check

Raj labels a semantic model as 'Confidential'. An analyst creates a new report connected to this model. What happens to the report's sensitivity label?

Next up: Git Version Control in Fabric