The Power BI Admin Portal, Tenant Settings, and Governance

// HOW TO SCOPE A TENANT SETTING TO A SECURITY GROUP
// Example: Allow "Publish to web" only for the Marketing team

// Step 1 — Create a security group in Microsoft Entra ID
// Entra Admin Centre → Groups → New group
// Group type: Security
// Group name: PBI-PublishToWeb-Allowed
// Members: add the specific users who need this capability
// Save the group

// Step 2 — Apply the scope in the Admin Portal
// Admin Portal → Tenant settings
// Find: "Publish to web"
// Toggle: Enabled
// Apply to: Specific security groups
// Add group: PBI-PublishToWeb-Allowed
// Save

// Step 3 — Confirm the scope is applied
// A user in PBI-PublishToWeb-Allowed will see:
//   Report → File → Embed report → Publish to web   (visible)
// A user NOT in the group will see:
//   Report → File → Embed report → Publish to web   (grayed out or hidden)

// IMPORTANT: Security group membership changes take up to 15 minutes
// to propagate in the Power BI Service. If a user does not see the
// expected change immediately, wait 15 minutes and refresh the browser.

// Accessing usage metrics — two levels

// WORKSPACE LEVEL (for workspace admins)
// Workspace → select a report → "..." → View usage metrics report
// Shows a pre-built report with:
//   - Unique viewers in the last 90 days (by day)
//   - Total views per report page
//   - Views by platform (web, mobile, embedded)
//   - Distribution method (direct access, app, shared link)
//   - Top viewers by name and view count

// TENANT LEVEL (for Power BI Administrators)
// Admin Portal → Usage metrics
// Shows the organisation-wide picture:
//   - Monthly Active Users (MAU) trend
//   - Most viewed reports and dashboards across the tenant
//   - Report opens and dashboard views by workspace
//   - Dataset refresh counts
// Export to Excel for deeper analysis

// MICROSOFT 365 AUDIT LOG (for compliance teams)
// Admin Portal → Audit logs → Go to Microsoft 365 admin centre
// Search audit logs for specific activities:
//   Activity: "Viewed Power BI report"
//   Date range: last 90 days
//   User: specific user or all users
// Results show: user, timestamp, report name, workspace, IP address
// Export as CSV for compliance reporting

// POWER BI ACTIVITY LOG (via PowerShell API)
// For automated monitoring, use the REST API or PowerShell:
// Install-Module -Name MicrosoftPowerBIMgmt
// Connect-PowerBIServiceAccount
// Get-PowerBIActivityEvent -StartDateTime "2025-01-01" -EndDateTime "2025-01-31"
//   | Where-Object {$_.Activity -eq "ExportArtifact"}
//   | Export-Csv -Path "C:\Audit\ExportEvents.csv"
// This approach logs every export event — essential for data loss prevention audits

// Managing Premium capacity — Admin Portal steps

// Step 1 — Assign a workspace to Premium capacity
// Admin Portal → Capacity settings → select your capacity → Workspaces
// Or: Workspace → Settings → Premium → Capacity name → select from dropdown
// Only Premium administrators or capacity administrators can reassign workspaces

// Step 2 — Monitor capacity health
// Admin Portal → Capacity settings → [your capacity] → Health
// Key metrics to watch:
//   CPU %:      if consistently above 70%, workloads are competing for compute
//   Memory %:   if consistently above 80%, datasets are being evicted frequently
//   Wait time:  how long queries queue before execution begins
// Download the "Power BI Premium Capacity Metrics" app from AppSource
// for the best detailed capacity monitoring dashboard

// Step 3 — Configure workload settings
// Capacity → Workload settings
//   Datasets max memory: 20 GB (default) — max memory for a single dataset refresh
//   Dataflows compute engine: on/off (Enhanced compute engine accelerates dataflows)
//   Paginated Reports: enable/disable for this capacity
//   AI/ML workloads: enable for AutoML and cognitive services in dataflows

// Step 4 — Set capacity administrators
// Capacity → Administrators → add users who can manage this capacity
// Capacity admins can: assign/remove workspaces, change workload settings,
//                      pause/resume the capacity (Embedded only)
// Capacity admins CANNOT: see tenant settings, access other capacities

// Step 5 — Scale the capacity SKU (when needed)
// Pausing and resizing is only available for Embedded (A SKUs), not Premium (P SKUs)
// For Premium P SKUs, scaling up requires a support ticket to Microsoft
// Plan capacity sizing before deployment — P1 (8 v-cores), P2 (16 v-cores), P3 (32 v-cores)

// GOVERNANCE CHECKLIST — large Power BI deployment
// Use this as a baseline for any enterprise Power BI rollout

// 1. WORKSPACE NAMING CONVENTION
//    Enforce: [Department] – [Purpose] – [Environment]
//    Example: Finance – Monthly Close – Production
//             Finance – Monthly Close – Development
//    Prevents: "John's workspace", "Test", "New workspace 3"

// 2. WORKSPACE LIFECYCLE POLICY
//    Every workspace must have:
//      - A designated workspace admin (not just "members")
//      - A documented purpose in the workspace description
//      - A review date (quarterly) to assess active use
//    Workspaces with no activity in 90 days: archive or delete

// 3. DATASET OWNERSHIP AND CERTIFICATION
//    Identify 5–10 "golden datasets" (Sales, Finance, HR, etc.)
//    Assign each a data owner (business + IT co-ownership)
//    Certify golden datasets → they appear first in searches
//    Policy: all certified datasets must have:
//      - Row-level security configured where needed
//      - A documented refresh schedule and an on-call contact
//      - Incremental refresh enabled for tables > 1 million rows

// 4. EXPORT CONTROLS
//    Sensitive datasets: disable Export to Excel at the dataset level
//    Dataset → Settings → Export data → "Users can export summarised data only"
//    OR disable completely if classification requires it
//    Combine with sensitivity labels for audit-trail on exports

// 5. EXTERNAL SHARING POLICY
//    Approved use cases for external sharing defined in writing
//    Approvals logged in a SharePoint register
//    All external shares reviewed quarterly — revoke stale access
//    "Publish to web" disabled globally (enable only via named security group)

// 6. ROW-LEVEL SECURITY SIGN-OFF
//    Every report that contains HR, payroll, or financial data
//    must have RLS reviewed by the data owner before publishing
//    RLS review checklist:
//      - Correct roles defined?
//      - Users assigned to roles?
//      - Tested with "View as" for each role?
//      - Edge case: what does a user with NO role assignment see?