2.4.4. Sensitivity Labels and Endorsement
💡 First Principle: Sensitivity labels and endorsement provide metadata-level governance—like classification stamps on documents. They inform users but don't technically enforce access. Think of them as warning signs: "CONFIDENTIAL" on a folder doesn't lock the folder, but it tells people to handle it carefully.
Scenario: A lakehouse contains both public marketing data and confidential M&A information. Sensitivity labels help users understand data classification; endorsement certifies which datasets are approved for business use.
Sensitivity Labels
- Source: Microsoft Purview Information Protection. Labels are created in the Microsoft Purview portal and published to users through a label policy; applying one to a Fabric item requires edit permission on it
- Levels: Public, Internal, Confidential, Highly Confidential
- Purpose: Classify data by sensitivity
- Behavior: Labels can flow downstream (e.g., from lakehouse to report)
Endorsement
| Level | Meaning | Who Can Apply |
|---|---|---|
| Promoted | Creators consider it ready for sharing and reuse | Any user with write permission on the item |
| Certified | An organization-authorized reviewer confirms it meets quality standards and is authoritative | Only users a Fabric admin designates (can be delegated per domain); anyone can request certification |
| Master data | Core, single-source-of-truth data such as customer lists or product codes | Only users a Fabric admin designates; data items only (e.g., lakehouses, semantic models) |
| No endorsement | Default state | N/A |
Label Inheritance and Downstream Flow
Sensitivity labels can automatically propagate to downstream items:
Lakehouse (Confidential) → Dataflow → Semantic Model → Report
└── Label flows downstream automatically ──────────┘
| Source Item | Derived Item | Label Behavior |
|---|---|---|
| Lakehouse | Report built on it | Inherits label |
| Semantic Model | Dashboard | Inherits label |
| Multiple sources | Combined report | Highest sensitivity wins |
When to Use Sensitivity Labels vs. Endorsement:
| Goal | Use This | Why |
|---|---|---|
| Classify data sensitivity | Sensitivity Label | Indicates handling requirements |
| Mark data as production-ready | Certified endorsement | Indicates data quality/approval |
| Recommend a dataset for use | Promoted endorsement | Guides users to preferred sources |
| Enforce access restrictions | RLS/CLS/Workspace roles | Labels don't enforce—they inform |
| Group workspaces by business area for discovery and federated governance | Domain (see 2.1.2) | Organizes; doesn't classify or certify |
| See which pipelines, models and reports depend on an item before changing it | Lineage view (see 1.3.2) | Traces upstream/downstream dependencies |
⚠️ Exam Trap: In the Fabric service a sensitivity label doesn't grant or remove access by itself (label-based access control needs a Purview protection policy); access is still workspace roles, item permissions and RLS/CLS. What a label can enforce is protection on data that leaves the service through a supported path (Export to Excel, PDF or PowerPoint, Analyze in Excel, download to .pbix): the label goes with the file and its encryption settings protect it. Export to .csv is not a supported path, so it carries no label or protection, and a label with no encryption configured classifies an exported file without encrypting it.
⚠️ Common Pitfall: Assuming "Certified" means "secure." Certification indicates data quality and approval, not security classification. A dataset can be Certified but still Public, or Confidential but not yet Certified.
