Chapter 2

10 Steps to Regain (or Establish) Control

Reclaim control, establish ownership, and shape management (including monitoring) and governance.

Failing to take serious action in this regard can have significant consequences for the success of your Power BI environment. Procrastination, in the form of a lack of management, can lead to long-lasting problems. The transition to Power BI Premium, for instance, provides an ideal opportunity to set up your Power BI environment effectively. Other organizations looking to take the next step in their maturity in Self-Service Analytics can draw inspiration from these steps.

1. Get to Know Your (Potential) Users

Understanding the landscape of Power BI usage within your organization begins with a solid grasp of your users. We define the following five user types:

Report Consumer
Report Analyst
Self-Service Data Analyst
Basic Data Analyst
Advanced Data Analyst

A good starting point for defining your own user groups is to analyze their current Power BI usage. The Power BI audit log is an excellent source of information. Which users are creating datasets? How many users have access to reports and dashboards? How frequently do they use them? These answers will also help you identify which users are not using Power BI (fully). Subsequently, you can convert the results, in collaboration with representatives from the different user groups, into actions for better adoption. This is also an opportune moment to identify Analytical Champions. These Power BI enthusiasts can play a crucial role as key users in influencing your other Power BI users.

2. Gather Deeper Insights

The usage statistics provided in the Power BI admin portal offer basic information but may not help you when you're seeking actionable insights. For that purpose, Power BI provides several other sources of information:

Power BI Audit Logs record various user activities (such as viewing reports, creating datasets, exporting reports, etc.). You can use the audit logs from both a usage perspective (what's the usage of Power BI in my company?) and a security perspective (who is exporting or deleting data?). If you want to store these data historically, one option is to develop your solution. Another option is the Azure Monitor integration, which will be available shortly.

3. Establish a Power BI Competence Center

A Power BI Competence Center ensures better utilization of Power BI, knowledge retention, and the professionalization and standardization of processes.

It achieves this through management, including access management, usage management, and, in the case of Power BI Premium, capacity management. Another task is ensuring and assessing data quality and reporting through the validation and certification of content. The most common and impactful tasks of the Power BI Competence Center include:

Supporting Consumers

Many Consumers benefit from end-user training, where they learn how to work with the Power BI environment. This training can be conducted in a classroom setting or recorded and shared as a video. Additionally, organizing drop-in sessions, lunchtime meetings, Q&A sessions, and hands-on workshops can be helpful. Keep Consumers informed about new developments through various channels (Teams, email, Yammer) and regularly share tips, best practices, and success stories.

Supporting Creators

Creators, in contrast to Consumers, actively work with Power BI Desktop. Therefore, they have a more extensive training requirement. Training sessions, drop-in sessions, and Q&A sessions cover topics such as data modeling, DAX, M-query, and visualization techniques. Power BI releases updates every month. To keep Creators well-informed, it's advisable to regularly share knowledge about new features and demonstrate new functionality. When a Creator encounters difficulties, it's necessary to provide support. Analytical Champions can play a role here.

Leveraging Analytical Champions

The best creators are often true Analytical Champions. These users are at the forefront of usage, can inspire others, and can transfer knowledge to other creators. When a creator faces challenges, it's advisable to connect them with an Analytical Champion who has more knowledge and experience in the same business domain. The Analytical Champion can thus, in consultation with the administrators and experts in the Competence Center, take over part of their work. The number of Analytical Champions and the amount of time they spend supporting colleagues naturally depend on the organization's characteristics.

4. Ensure a well-defined role distribution within the Competence Center

Different activities call for matching roles, each with a unique skill set. It's a challenging task to find a Power BI expert who excels in performing administrative tasks, training users, providing support, and identifying innovation opportunities. Although roles within the Competence Center can be combined depending on the team's size, a good role distribution looks like this:

The Lead: The Lead serves as the bridge between the Competence Center and the rest of the organization. This individual can analyze and sell the business value of Power BI and aligns the activities of administrators, experts, Analytical Champions, and users.
The Power BI Administrator: The Power BI Administrator is responsible for maintaining a healthy and manageable Power BI platform. This involves activities such as license management, user management, access control, and monitoring. This person coordinates periodic assessments and is the first point of contact for users in case of requests or incidents.
The Power BI Expert: The Power BI Expert is well-versed in the technical and functional capabilities and limitations of Power BI. They also have experience in building data models, crafting complex calculated columns and measures, and understanding the concepts of performance tuning. This individual provides advanced Power BI training and supports advanced users with complex issues. They also closely monitor new releases and updates, and experiment with new preview features.
The Analytical Champion: The Analytical Champion is a member of both the Competence Center and a business team. Often, Analytical Champions are users with roles like Analyst or Controller, such as Marketing Analyst, Business Analyst, or Finance Controller. These Power BI enthusiasts can play a crucial role as Key Users in guiding other users towards successful use of Power BI.

5. Distinguish Between Managed and Self-Service BI Content

Traditionally, Business Intelligence has been the realm of management reports, often referred to as 'Managed BI.' These reports are typically created by a centralized team and made available to users. Organizations using Power BI often still require controlled, validated, and centrally maintained management reports. However, Power BI provides ample room for Self-Service BI, granting users extensive capabilities to independently generate insights and performance data.

In this context, it's crucial for every user to clearly identify the type of content they're dealing with: Managed BI content or Self-Service BI content. Certifying and promoting Managed BI content is a good starting point. Additionally, you can employ a branding or badge system to easily classify reports and dashboards as 'Managed BI content.' Lastly, it's advisable to use a naming convention for Managed BI workspaces. This can be as simple as prefixing these workspaces with labels like 'BICC_' or 'ACE_.' Find out more about how to use branding or badges to easily classify reports and dashboards as 'Managed BI' content.

6. Maintain Control Over Workspace Creation

Power BI's default setting allows anyone with a Power BI Pro license to create workspaces. Add to that the workspaces created for each new Office 365 group if you've enabled this setting, and it's not unlikely for your company to host hundreds or even thousands of workspaces. It's no surprise that this situation can become unmanageable over time. Who created which workspace? What data is being shared? Who has access? These are all vital questions when it comes to maintaining control.

However, there's a dilemma. The concept behind workspaces is to enable groups of Creators to collaborate. This includes co-creating at the dataset level, reusing dashboards in new reports, or building dashboards on top of existing reports. You can prevent chaos by allowing only a central administrator to create workspaces. The downside is that it leads to bureaucratization and can frustrate your users. Moreover, it doesn't serve as a catalyst for user adoption of Power BI.

The alternative (the best of both worlds) is to allow workspace creation only for a specific group of users. This group could comprise a combination of your centralized ACE/BICC team and your Analytical Champions. With this approach, your users have the freedom to create workspaces and collaborate within some degree of control and regulation. Together with your Analytical Champions, you can decide on a process for workspace creation and optionally implement a naming convention for workspaces.

7. Implement an Onboarding Process

Assigning workspaces to Power BI Premium Capacity is a manual step performed by a Power BI Administrator or Power BI Premium Capacity Administrator. This is the perfect opportunity to make improvements based on quality control. Some activities that should be part of the process include:

Upgrading classic workspaces to modern workspaces
Utilizing a naming convention
Security and access control
Data check
Performance check
Quality check

8. Certify & Promote Power BI Content

Certify

From both a performance and quality perspective, maintaining a high standard for created datasets and reports is crucial, especially when these datasets are running on your Premium Capacity. Power BI offers a setting that allows you to certify Power BI content, making it easier for users to find reliable datasets. This enhances trust and fosters more data-driven decision-making. Enabling this setting in the admin portal takes just a few seconds, but defining and implementing the process behind it is key to maximizing this feature.

Depending on the size of your organization and the level of Self-Service, the volume of generated content can be overwhelming. However, for datasets running on Premium Capacity, certifying content is highly recommended and should be a standard part of the onboarding process.

Promote

In addition to certifying, it's also possible to promote reports, dashboards, and apps. While certifying is a responsibility of the central team, promoting is a tool for Creators. This way, they can bring their reports to the attention of Consumers, making the content easier to find on the main page.

As an organization, you can choose to grant every Power BI Creator the rights to promote datasets, but it's wiser to limit this to the Analytical Champions. If all Creators can promote their content, the functionality might lose its purpose, and users might struggle to determine which content is of high quality.

9. Monitor and Analyze Your Premium Capacity Proactively

Proactive Monitoring and Analysis

With the release of Power BI Premium Gen2, the ability to monitor, analyze, and troubleshoot your Premium Capacity has significantly improved. Microsoft has created a Gen2 Metrics app that displays resource usage at the operational level (queries, scheduled dataset refresh, rendering, etc.). The dataset can hold up to 45 days of data. With the upcoming integration with Azure Monitor, you can store this data historically and analyze it on your own.

Monitor Costs

In the case of Shared Capacity (Power BI Pro only, no Premium), costs can be easily allocated to departments (or other organizational units) based on the number of Power BI Pro licenses. You can use the Office 365 Admin Portal or PowerShell for this.

10. Prioritize Security to Prevent Data Breaches

Security should be one of your top priorities, especially when your datasets contain personal or financially sensitive information. Microsoft provides the toolkit to ensure that your Power BI environment is secure. Power BI uses Azure Active Directory for authentication by default (optionally with Multi-Factor Authentication) and encrypts your data in transit and at rest.

However, this doesn't mean your environment is automatically secure, and data can't fall into the wrong hands. There is no one-size-fits-all solution for security requirements and settings, but some aspects are relevant to everyone:

Enable Multi-Factor Authentication (MFA): Although not part of Power BI itself, a good starting point is to enable Multi-Factor Authentication.
Apply the least-privilege principle to workspaces: Users who only need to access a report do not need access to a workspace. Users with the role of administrator can add new users and delete the workspace themselves.
Allocate these rights carefully. You can programmatically retrieve a list of workspace administrators via PowerShell / REST API, which can assist in periodic checks.
Use apps to distribute content to Consumers: If your users only need to view a report or dashboard and don't require access to the underlying dataset (consumers, not creators), using an app is the right choice.
Authorization based on group membership: Whenever possible, grant access based on group membership rather than individual user accounts.
Review your Power BI Tenant settings: In the admin portal, there are some essential Tenant settings. The most critical settings that are enabled by default for everyone include 'create workspaces,' 'share data externally,' 'export data,' and last but not least, 'publish to web.'
Use Sensitivity Labels to indicate the level of confidentiality for each report: This is a setting for the entire Office 365 suite. It allows you to label emails, documents, as well as Power BI reports by confidentiality. The labels are: Public, Confidential, and Highly Confidential.
Consider external tool exports: Reports can be exported to various tools like PDF, Word, Excel, and PowerPoint. In the Power BI Admin Portal, you can limit these export functionalities. Exporting is often popular among Consumers but can be a concern for administration. Where is the data going? What filters are applied, and when was the data exported? You can disable the export option, but you can never rule out users taking screenshots or finding other ways to export data. Alternatively, you can choose to enable exporting and monitor who is exporting data through Power BI Audit Logs. You can then engage in a conversation with these users.