Your dashboards are only as governed as the data behind them. Here’s how to bring firm-financial analytics into Power BI and Microsoft Fabric without turning a dashboard into a data-leak.
Reading time: about 6 minutes • Topics: Microsoft Fabric, Power BI, Microsoft Purview, Row-Level Security, Data Governance, Legal
Everyone wants the dashboard. Almost no one asks who can see the numbers inside it. When a firm finally connects its financial system to Power BI, the excitement is real: matter profitability, realization, WIP and AR aging, revenue by partner, all live and beautiful. And then a partner opens a report and sees compensation-sensitive figures for an office, a practice group, or a colleague they were never meant to see.
Business intelligence has a governance blind spot. The conversation about Copilot and oversharing has (rightly) focused on documents and SharePoint. But the same sensitive data (client financials, matter economics, partner compensation) also flows into analytics platforms, where it’s often governed far more loosely than the documents it came from. A governed BI deployment closes that gap on purpose.
Across the analytics work we do for law firms and professional-services organizations, the winning pattern is consistent: treat governance as a first-class part of the BI build, not a step you bolt on before go-live. Here’s what that looks like when the source is a firm’s on-premises financial system and the destination is Microsoft Fabric.
The Challenge: Sensitive Financials, Broad Audience
A typical engagement starts with a firm wanting real-time insight into performance (profitability, realization, collection cycles, fee-earner utilization) drawn from an on-prem legal financial system such as Elite 3E into modern, cloud-native analytics. The upside is obvious. The governance problem is just as obvious once you look:
- The most sensitive data in the firm. Matter economics and partner-level financials are among the most confidential numbers an organization holds, and now they’re leaving a locked-down SQL database for a shareable dashboard.
- A broad, mixed audience. Executives, office heads, practice-group leaders, and finance all want views, but each should see only their slice, not the whole firm.
- No lineage, no labels by default. Move data into a lake and a semantic model, and its original sensitivity classification doesn’t follow it, unless you deliberately carry it across.
- Solve this by building governance into the architecture from the first pipeline, not by hoping report authors restrict access correctly after the fact.
The Governed BI Model: Four Controls That Travel With the Data
Governed BI on Microsoft Fabric rests on four controls, applied together so protection follows the data from source to report:
| Control | What It Does | How (Fabric / Purview) |
|---|---|---|
| Row-Level Security (RLS) | Ensures each viewer sees only their office, practice group, or partner scope. | RLS roles on the semantic model, mapped to Entra ID identity: one dashboard, many governed views. |
| Purview Sensitivity Labels | Carries the data’s classification into the analytics layer, using the same taxonomy as the rest of the estate. | Labels applied to datasets, semantic models, and columns in Power BI and Fabric; consistent with M365 labels. |
| Cataloging & Lineage | Proves where a number came from and who owns it, which is essential for trust and audit. | Register Fabric assets; scan Lakehouse and Warehouse metadata; demonstrate lineage from source to report. |
| Governed Semantic Layer | A single curated model as the one governed source of truth for reporting. | Star-schema model (billing, matter, client, timekeeper) with report-level calculations kept minimal. |
The principle: a label applied in Purview and a role enforced in Fabric should mean the same thing they mean everywhere else in the firm. Governance isn’t a separate BI dialect. It’s the firm’s taxonomy, extended to analytics.
How We Do It: A Governed Proof of Concept
1. Secure the Pipeline, Not Just the Report
We establish a hybrid connection from the on-prem financial system into Microsoft Fabric via a data gateway and pipeline, ingesting a controlled subset of financial and timekeeping data into OneLake, without disrupting production. Governance intent is set here: what data moves, how it’s modeled, and what classification it carries. We use medallion layers for traceability so every number is auditable back to source.
2. Model Once, Govern Everywhere
We build a curated star-schema semantic model, the single governed reporting layer, with the firm’s real metrics (realization, WIP days, collection cycle, fee-earner utilization). Then we apply the controls that make it safe to share: Row-Level Security so each audience sees only its scope, and Purview sensitivity labels on datasets and columns so the data’s classification is visible and enforceable inside Power BI, not just in the source.
3. Validate, Prove, and Plan for Scale
Governance you can’t demonstrate isn’t governance. We validate role-based access with finance and IT, produce a Purview data-governance report showing classification and lineage, and capture Fabric capacity and cost drivers early so production sizing is intentional rather than a surprise. The deliverable is a governed dashboard, a signed-off test report, and a clear roadmap to full production rollout
Why This Matters Now
Two forces are converging. Firms are modernizing analytics onto Microsoft Fabric at exactly the moment they’re also racing to adopt AI, and AI increasingly reaches into the same semantic models and datasets. A sensitivity label on a Power BI dataset isn’t just about who can open a report today; it’s about ensuring that when Copilot or an agent queries that data tomorrow, the same classification and controls already apply. Governed BI and governed AI are the same discipline, viewed from two angles.
The Takeaway for Legal and Enterprise Leaders
A dashboard that surfaces the wrong number to the wrong partner isn’t an analytics win. It’s a confidentiality incident with a nice chart on top. Build governance into your BI from the first pipeline, and your data stays classified, scoped, and auditable all the way to the report.
Modernizing analytics on Power BI or Microsoft Fabric, and want to be sure sensitive financials stay governed end to end? Canalini Consulting Group designs governed BI on Fabric with Purview classification and Row-Level Security built in from day one. Let’s talk.
Note: This article describes patterns and practices drawn from our analytics and data governance engagements; it does not reference any specific client. Canalini Consulting Group is a Microsoft Gold Partner specializing in AI data governance, Microsoft Purview, Fabric, and secure Copilot adoption.
