The direct answer
EPC Group governs Power BI at the two levels Microsoft's implementation planning separates. At the tenant level, a Center of Excellence owns the tenant settings, decides who may create workspaces, and publishes the standards for naming, certification and sharing. At the workspace level, every workspace has a stated purpose, named owners, defined roles and a lifecycle from creation through certification to archive (Microsoft Learn, Implementation planning: Workspaces, accessed 2026-10-26).
Security sits inside the semantic model, because a user who can open a report reaches the whole underlying model unless row-level security limits it; EPC Group designs row-level security, and object-level security where columns must be hidden, as part of the model. Microsoft Purview sensitivity labels are applied to semantic models, reports, dashboards and dataflows. In the service a label does not change access, which Power BI permissions decide; it travels with data that leaves Power BI through export to Excel, PowerPoint, PDF or a .pbix download and protects it there (Microsoft Learn, Sensitivity labels in Power BI, accessed 2026-10-26). The governance model is kept true by a monthly review of the audit log and the workspace inventory.
Where each decision is made
| Level | Decision | What EPC Group delivers |
|---|---|---|
| Tenant | Settings, workspace creation, sharing and export rules | Center of Excellence charter and tenant-settings register |
| Workspace | Purpose, owners, roles, lifecycle | Workspace model with naming, certification and archive rules |
| Semantic model | Who sees which rows and columns | Row-level and object-level security, tested per role |
| Content | Classification and protection on export | Purview sensitivity labels and the label policy |
| Operations | Is the model still true? | Monthly audit-log and workspace-inventory review |
Documented work
EPC Group engagement data for Power BI governance includes a governance strategy, delivery model and security standards for a global insurer (anonymized engagement summary), a proof of concept, governance model and 36-month roadmap for a global electronics manufacturer (anonymized engagement summary) and row- and column-level security for partner clinics in a healthcare services company's Power BI reports (anonymized engagement summary). Client names are not published. Source records are in the Evidence Center.
Primary sources
- Implementation planning: Workspaces — Microsoft Learn, accessed 2026-10-26
- Sensitivity labels in Power BI — Microsoft Learn, accessed 2026-10-26
Frequently Asked Questions
Does EPC Group use sensitivity labels in Power BI?
EPC Group applies Microsoft Purview sensitivity labels to semantic models, reports, dashboards and dataflows. In the Power BI service a label does not change who can open content, which Power BI permissions decide; it protects data that leaves Power BI through export to Excel, PowerPoint, PDF or a .pbix download.
Who can create workspaces under EPC Group’s governance model?
EPC Group decides that with each client at the tenant level and writes it into the governance model: who may create workspaces, how they are named and what each one is for. Workspaces that lose their purpose are archived on a schedule rather than left to accumulate.
How does EPC Group secure data inside a shared semantic model?
EPC Group designs row-level security, and object-level security where columns must be hidden, into the semantic model itself, because a user who can open a report can reach the whole underlying model unless row-level security limits it.
Talk to a senior architect
A one-hour scoping call with a senior EPC Group architect covers your tenant settings, workspaces and models. Email contact@epcgroup.net or call 888-381-9725.
Documented and anonymized engagements
Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.
- Town of Prosper, Texas — Power BI data project (2024)Town of Prosper, Texas · 2024 · Contracted
- Smarter Balanced (University of California, Santa Cruz) — Power BI consulting and development with Power BI Embedded (2023)Smarter Balanced (University of California, Santa Cruz) · 2023 · Contracted
- Haskell (The Haskell Company) — Power BI Report Server to Power BI Service migration (2019)Haskell (The Haskell Company) · 2019 · Contracted — countersigned
- Power BI Weld QA/QC and Fabric: Industrial Contractor (2026)Anonymized engagement summary · Industrial construction contractor · 2026
- Azure Data Warehouse and Power BI: Medical Devices (2025)Anonymized engagement summary · Medical device manufacturer · 2025
- Data Warehouse and Partner Power BI: Healthcare (2025)Anonymized engagement summary · Healthcare services company working with partner clinics · 2025
- Power BI and Copilot Training: Truck Dealer Group (2023–25)Anonymized engagement summary · Commercial truck dealership group · 2023–2025
- Urgent Power BI Model Fix: Healthcare Technology (2025)Anonymized engagement summary · Healthcare technology company · 2025
More engagements: Power BI Tax Reporting on MySQL: Tax Services Firm (2024) · Power BI Ops Dashboard: Transit District (2023) · Power BI Report Server Refresh Fix: Agribusiness (2021) · Power BI, Data Warehouse and External Reports: Gaming (2021) · SAP Reports to Power BI in 90 Days: Aerospace (2021) · Power BI Governance Strategy: Global Insurer (2020) · Power BI on HR System Data: Construction Contractor (2020) · Power BI POC, Governance and Roadmap: Electronics (2020) · Power BI Assessment and Integration: Pharmacy (2019) · Power BI Proof of Concept: Global Technology Company (2019) · Power BI Best-Practice Review and Training: Insurer (2018) · Power BI Analytics Platform: State Government · Power BI Enterprise Deployment: Financial Institution