Power BI Tenant and Admin
The knobs that make it a governed platform
Tenant administration runs Power BI as an enterprise platform: capacity management, Power Platform settings, RLS/OLS, lineage, retention, audit logs and monitoring. Governance lives in these knobs.
What you will learn
- Manage workspaces and content storage at the tenant level
- Apply admin settings: exports, shares, certified datasets, usage metrics
- Use the audit log and monitoring to operate at scale
What is this?
Tenant administration is where Power BI becomes governance: capacity planning (Pro/Premium/Fabric SKUs), storage, workspace lifecycle, admin settings (who can export, publish, create workspaces), access and RLS oversight, retention policies, lineage, and audit logging. The admin portal is the difference between a platform with guardrails and 400 organic PBIX files.
Why do you need it?
- Un-governed tenants explode: duplicate datasets, untrusted numbers, permission sprawl.
- Compliance requires you to answer 'who can see this and who exported it?'.
- Capacity tuning avoids premium-cost surprises and refresh failures.
- Admin decisions (certification, shared datasets, exports) define self-service safety.
Mental model
A city's building codes and permits
Tenant administration
Anyone can build (self-service), but codes (admin settings), permits (workspaces/apps), inspectors (audit) and zoning (capacity) keep the city livable. Without them, it's a shanty town of different-width doors.
How it works
- Admin portal centralizes workspaces, datasets, capacities and settings.
- Workspace creation/publish/export policies constrain organic sprawl.
- Capacity management sizes compute; refresh and concurrency live in the capacity.
- Audit logs (Microsoft 365/Defender) record export, access and sharing events.
- Lineage, certification and usage metrics drive the governance cadence.
Admin levers around the tenant.
In production
- IT limits who can create workspaces and require certified datasets for 'shared' content.
- Capacity admins set refresh intervals and monitor utilization so 6am refreshes never queue behind exec queries.
- A quarterly audit answers 'what did each role export and who viewed the PII dashboard?' from logs.
Best practices
- Apply least-privilege at the workspace and tenant settings layer.
- Require certification before content is broadly shared.
- Turn on and review audit logging plus usage metrics.
- Automate workspace lifecycle (create/archive/delete) and cap exports to governed datasets.
Common mistakes
- Admin-by-Legacy: opening all exports and workspace creation to avoid tickets.
- Ignoring capacity utilization until premium costs surprise finance.
- No audit review cadence — governance features on but unexamined.
- Treating delegation of tenant admin as 'set and forget'.
Common issues
Premium capacity outage during month-endUndersized capacity + all refreshes at 6am
Spread refresh schedules, pre-aggregate, and scale capacity with headroom.
Unauthorized export discoveredExport setting too open + no audit review
Restrict exports, add data-protection labels, and audit weekly.
Debugging tips
- Refresh failures at a scale → check capacity utilization and workspace 'small model' settings.
- Who exported what? Search the audit activity log by user/content.
- Sprawl rising? Check workspace-creation settings and dataset duplication reports.
Interview checkpoint
Quick quiz
Which tenant construct most directly controls who may publish and share?
Audit logs are optional for a compliant Power BI deployment.