Power BI setup and governance: data model, security and agreements
How to set up Power BI so every report uses the same figures, access is controlled and someone owns each model.
In this topic: IT and data 18
The first Power BI report is usually built in an afternoon. Someone in finance connects the accounting system, adds a few charts and the management team is impressed. Eighteen months later there are thirty reports, each with its own copy of the data. Two of them show a different revenue figure for the same month, the person who built them has left, and nobody dares to change anything.
- Every report fetches and calculates its own figures
- Two reports, two revenue figures for the same month
- Figures are defined once, in the model
- Every report shows the same revenue
The software is rarely to blame. The problem is a model that was never designed and agreements that were never made. This guide shows how to set Power BI up so that it still works when the tenth report and the fiftieth user arrive.
Build one well-designed semantic model per subject and let every report use it. Keep building and production apart, use row-level security to control who sees which rows, and give every model an owner who decides on definitions. The technology is the smallest part of the work.
- Data model
- Security
- Governance
- Finance
How Power BI is put together
Power BI works in layers, each with its own job. Most problems start when one layer quietly does the work of another, for example when a report recalculates revenue in its own way.
Data comes in from the sources, is cleaned in Power QueryPower QueryThe tool in Power BI and Excel that fetches data from sources and cleans and shapes it, the same way on every refresh. and lands in the semantic modelSemantic modelThe layer with the tables, relationships and calculations that reports are built on. It used to be called a dataset.: the tables, the relationships between them and the calculations. Reports only show what the model offers, and readers get those reports through an app.
The semantic model used to be called a dataset; Microsoft renamed it (source: Microsoft, November 2023). Power BI is now part of Microsoft Fabric, Microsoft's wider data platform (source: Microsoft, March 2026).
Which licences you need depends on who builds, who reads and whether your organisation reserves capacity (computing power at Microsoft dedicated to your organisation). Check current prices and licence rules on Microsoft's website, because they change regularly.
Star schema, measures and one shared model
According to Microsoft, the star schema is highly relevant for Power BI models that need to perform well and be easy to use (source: Microsoft, December 2024).
In the middle sits a fact table with events: ledger entries, order lines, hours worked. Around it sit dimension tables that describe those events: date, customer, ledger account, cost centre (source: Microsoft, December 2024).
One wide table with everything in it feels quicker at first, but becomes slow and unpredictable as it grows.
Definitions in the model
Write calculations once, as measures in DAX (the formula language of Power BI), and hide the raw number columns. Every report then uses the same gross margin.
One shared model
Let several reports use one model. Separating model and report promotes reuse and a clear division of tasks (source: Microsoft, December 2024).
Your own date table
Replace the automatic date tables with one date table that also holds your financial year and periods.
Refresh and the gateway
A report shows the data of the last refresh. For an imported model you set a schedule; how often it may run depends on your licence. If the Power BI service can reach the source directly over the internet, as with many cloud applications, no extra software is needed (source: Microsoft, September 2026). If the source sits on your own server, you need an on-premises data gateway: Windows software on one of your own machines that connects the service with the source through outgoing connections, so no inbound ports have to be opened (source: Microsoft, September 2026).
Use standard mode on a server that is always on, with two administrators. The personal mode runs on one person's laptop and cannot be shared. If a scheduled refresh fails, Power BI emails the model owner by default (source: Microsoft, September 2026); make sure that person acts on it.
Keep development, test and production apart
A changed measure that goes straight into the board report will go wrong one day. Separate stages prevent that.
- 1DevelopmentBuilders change models and reports in their own workspaceWorkspaceA shared area in the Power BI service where a team builds, stores and manages models and reports.. Nobody outside the team looks at it.
- 2TestKey users check the figures against the ledger and test the security roles with real accounts.
- 3ProductionOnly approved content reaches the app that readers use.
Deployment pipelines move content from stage to stage inside Power BI itself, with development, test and production as the default stages (source: Microsoft, September 2026). Each stage is its own workspace, and those workspaces need Fabric or Premium capacity, or Premium Per User, a heavier per-user licence (source: Microsoft, September 2026).
Apply the same principle by hand: one workspace to build in and a separate production workspace for the app.
Row-level security: each manager sees only their own region
Row-level security (RLS) limits which rows a user gets to see. Filters restrict data at row level and are defined in roles (source: Microsoft, May 2026).
Take a wholesaler with four regions. The manager of the North region may see revenue, margin and receivables for the North and nothing for the South. The managing director sees everything. Both open the same report.
- Only the rows for the North
- Totals that cover the North only
- Every region
- The same report, no separate version
- 1Record who sees whatAn access table with each person's sign-in name and regions, fed from HR or a managed list.
- 2Create one role with a filter ruleIn Power BI Desktop the region table gets a rule: show only the regions linked to the signed-in user. USERPRINCIPALNAME() returns the sign-in name, which is not always the same as the email address (source: Microsoft, May 2026).
- 3Assign groups in the serviceUsers are assigned to roles in the Power BI service, not in Desktop. Microsoft recommends mapping security groups to roles (source: Microsoft, December 2024).
- 4Test with real usersCheck every role, including people who appear in no list at all. They should see nothing.
If someone is in two roles, the permissions add up, so a person in both "Board" and "Region" sees everything (source: Microsoft, December 2024).
RLS only restricts users with the Viewer role, not the workspace roles Admin, Member and Contributor (source: Microsoft, May 2026). A regional manager who is a member of the workspace sees every region.
Sensitivity labels and sharing
Sensitivity labels from Microsoft PurviewMicrosoft PurviewMicrosoft's set of tools for classifying, protecting and governing data across Microsoft 365 and other services. show how confidential a report is. Inside the Power BI service, access is decided by permissions, not by labels (source: Microsoft, November 2025). The label does matter once data leaves Power BI:
| Export or sharing route | Label travels along | What to do |
|---|---|---|
| Export to Excel or PDF | Yes | Allowed for readers who need it |
| Export to CSV (a plain text file) | No | Restrict for sensitive models |
| Publish to web | No | Anyone on the internet can view, without signing in; let the administrator switch it off or restrict it |
Share through apps with groups, not with individual people. For data about individual employees, such as absence or salaries, decide in advance with HR who may see what. The table is based on Microsoft's documentation on sensitivity labels and Publish to web (source: Microsoft, November 2025).
Agreements that keep Power BI reliable
Four agreements prevent most of the chaos from the opening paragraph.
An owner per model
A business owner, such as the controller for the financial model, decides on definitions. A technical administrator keeps it running.
Promoted and Certified
Promoted means the creator considers the model ready for reuse. Certified means a designated reviewer approved it; only people appointed by the Fabric administrator can certify (source: Microsoft, July 2024).
Fixed names
One naming pattern for workspaces and measures: Revenue, Revenue prior year, Revenue budget. Users find their way without asking.
One page per model
Purpose, sources, refresh time, definitions and roles. Short enough that someone actually keeps it up to date.
Finance owns the definitions. IT keeps the model running.
Adoption, training and performance
Microsoft's adoption roadmap treats adoption as more than technology, with areas such as data culture, executive sponsorship and user support (source: Microsoft, December 2024). Train readers differently from builders: readers need to filter and know what they may export, builders need to know the shared model. A key user in each department catches questions before they reach IT.
- Load only what you use: remove columns and rows that no report needs, and switch off the automatic date tables.
- Fewer visuals per page: every visual is a query; Microsoft advises limiting their number on a page (source: Microsoft, December 2024).
- Measure, do not guess: the Performance Analyzer in Power BI Desktop shows how long each visual takes to load.
- Import by default: Microsoft advises import mode by default; with DirectQueryDirectQueryA connection mode in which Power BI keeps no copy of the data and queries the source each time a visual loads. every visual sends queries to the source, so the source sets the speed (source: Microsoft, April 2026).
Financial reporting: ledger, periods, budget and closing
Financial figures have their own rules. Four of them decide whether the controller trusts the report.
Chart of accounts
Make the chart of accounts a dimension with the levels of the income statement and balance sheet, plus a sort column so revenue appears at the top. Record the sign: in many ledgers revenue is stored as a credit, so as a negative number. Subtotals such as gross margin belong in the model.
Periods
Put the financial year and accounting period in the date table, next to the calendar month. You need this as soon as the financial year differs from the calendar year or you work with four-week periods.
Budget versus actual
The budget is usually set per month and account group, actuals per entry. Link the budget to the first day of its period and leave the budget measure blank below the level at which it was set (source: Microsoft, November 2025). A version column keeps budget and forecast apart.
Closing
An open period still changes. Show whether a month is provisional or closed and align refreshes with the closing calendar. If a report must match what was discussed, keep a snapshot per close.
How healthy is your Power BI set-up?
Eight statements from this guide. Answer them for your own organisation and see where to start.
- 1Every subject has one shared semantic model that all its reports use.
- 2Key measures such as revenue and gross margin have a written definition.
- 3Scheduled refreshes run through a gateway on a server, not on a laptop.
- 4Changes are tested before they reach the report that management uses.
- 5Row-level security is set up and tested with real accounts.
- 6Readers get reports through an app, not as members of the workspace.
- 7Every model has a named business owner who decides on definitions.
- 8Report figures are reconciled with the ledger for every closed period.
Related guides
Set-up checklist, RLS worksheet and governance roles
Below you will find a set-up checklist per phase with the reason and the owner of each item, a worksheet to design row-level security before the first line of DAX, and a table that shows for each management task who does it, who decides, who is consulted and who is informed.
Frequently asked questions
What is the difference between a dashboard and a report in Power BI?
How many semantic models does an organisation need?
Does the data first need to be in a data warehouse?
Who should own the financial model: finance or IT?
- Microsoft Learn: Understand star schema and the importance for Power BI (December 2024)
- Microsoft Learn: Row-level security (RLS) with Power BI (May 2026)
- Microsoft Learn: On-premises data gateways in Power BI (September 2026)
- Microsoft Learn: Lifecycle management FAQ (September 2026)
- Microsoft Learn: Endorsement overview (July 2024)
- Microsoft Learn: Microsoft Fabric adoption roadmap (December 2024)