Deployment Admin

Deployment and Administration

Overview

Power BI deployment spans from development to production across workspaces, capacities, and environments. This skill covers deployment pipelines, CI/CD automation, security configuration, capacity management, and governance best practices.

Deployment Pipelines

Built-in Power BI feature for promoting content through environments:

Requirements: Premium, PPU, or Fabric capacity on all stage workspaces.

Deployment rules:

• Content types deployed: reports, semantic models, dataflows, paginated reports
• Parameterization rules handle environment-specific values (server names, databases)
• Backward deployment (prod to dev) is supported but use with caution
• Auto-bind connects deployed reports to the correct semantic model in each stage

Pipeline Automation via REST API

# Get deployment pipelines
GET https://api.powerbi.com/v1.0/myorg/pipelines

# Deploy all content from stage 0 (Dev) to stage 1 (Test)
POST https://api.powerbi.com/v1.0/myorg/pipelines/{pipelineId}/deployAll
{
  "sourceStageOrder": 0,
  "options": {
    "allowOverwriteArtifact": true,
    "allowCreateArtifact": true,
    "allowOverwriteTargetArtifactLabel": true
  },
  "note": "Automated deployment from CI/CD"
}

CI/CD with GitHub Actions

PBIP-Based Deployment

name: Power BI Deploy
on:
  push:
    branches: [main]
    paths: ['reports/**']

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Azure Login (Service Principal)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Get Access Token
        id: token
        run: |
          TOKEN=$(az account get-access-token \
            --resource https://analysis.windows.net/powerbi/api \
            --query accessToken -o tsv)
          echo "::add-mask::$TOKEN"
          echo "token=$TOKEN" >> $GITHUB_OUTPUT

      - name: Deploy via Fabric REST API
        run: |
          # Import PBIP to workspace using Fabric Git integration
          # or use deployment pipeline API
          curl -X POST \
            "https://api.powerbi.com/v1.0/myorg/pipelines/${{ secrets.PIPELINE_ID }}/deployAll" \
            -H "Authorization: Bearer ${{ steps.token.outputs.token }}" \
            -H "Content-Type: application/json" \
            -d '{
              "sourceStageOrder": 0,
              "options": {
                "allowOverwriteArtifact": true,
                "allowCreateArtifact": true
              }
            }'

Validation Step (Best Practice Analyzer)

      - name: Run Tabular Editor BPA
        run: |
          # Install Tabular Editor CLI
          dotnet tool install -g TabularEditor.TOMWrapper
          # Run Best Practice Analyzer
          tabulareditor model.bim -A BPARules.json -V

CI/CD with Azure DevOps

trigger:
  branches:
    include: [main]
  paths:
    include: ['reports/*']

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: PowerBIActions@5
    displayName: 'Deploy to Test'
    inputs:
      PowerBIServiceConnection: 'PowerBI-ServicePrincipal'
      Action: 'Publish'
      WorkspaceName: 'Sales-Test'
      PbixFile: '$(Build.SourcesDirectory)/reports/*.pbix'
      OverWrite: true

  - task: PowerBIActions@5
    displayName: 'Refresh Dataset'
    inputs:
      PowerBIServiceConnection: 'PowerBI-ServicePrincipal'
      Action: 'DatasetRefresh'
      WorkspaceName: 'Sales-Test'
      DatasetName: 'SalesModel'

Azure DevOps extension: Install "Power BI Actions" from the Visual Studio Marketplace for native pipeline tasks.

Fabric Git Integration

Native source control integration (GA since late 2023):

1. Connect workspace to repo: Workspace settings > Git integration > Connect 2. Supported repos: Azure DevOps Repos, GitHub (2025+) 3. Sync direction: Workspace to repo (commit) or repo to workspace (update) 4. Supported items: Reports, semantic models, notebooks, pipelines, lakehouses

Branching strategy:

• Main branch connected to Production workspace
• Feature branches for development
• PR-based review and merge
• Auto-sync on merge to main

Security

Row-Level Security (RLS)

Define in Power BI Desktop (Modeling > Manage Roles):

// Static RLS - filter by specific values
[Region] = "West"

// Dynamic RLS - filter by logged-in user
[Email] = USERPRINCIPALNAME()

// Dynamic RLS with lookup table
[ManagerEmail] = USERPRINCIPALNAME()
|| PATHCONTAINS([ManagerPath], LOOKUPVALUE(
    Employees[EmployeeID],
    Employees[Email], USERPRINCIPALNAME()
))

Testing:

• Desktop: Modeling > View as > select role (does not support USERPRINCIPALNAME)
• Service: semantic model settings > Security > test role with specific user
• Embedded: generate embed token with effective identity

Rules:

• RLS applies to Viewers only; Admins/Members/Contributors bypass RLS
• Must add users/groups to roles in the Power BI Service
• Service Principal can test RLS by generating tokens with EffectiveIdentity
• RLS filters propagate through relationships (single-direction)
• With bidirectional filtering, test carefully for security leaks

Object-Level Security (OLS)

Restrict access to specific tables/columns for certain roles. Configured via:

• Tabular Editor (recommended)
• TOM/.NET SDK
• XMLA endpoint with TMSL

// TMSL to add OLS
{
  "createOrReplace": {
    "object": { "database": "model", "role": "RestrictedUser" },
    "role": {
      "name": "RestrictedUser",
      "tablePermissions": [{
        "name": "Employees",
        "columnPermissions": [{
          "name": "Salary",
          "metadataPermission": "none"
        }]
      }]
    }
  }
}

Capacity Management

Fabric F-SKU equivalency (2026):

Key rule: F64 is the minimum Fabric SKU that includes Power BI content viewing rights for users without Pro/PPU licenses.

Workspace Management

Best practices:

• Use security groups for role assignment (not individual users)
• Separate workspaces per environment (Dev/Test/Prod)
• Use apps for end-user content distribution
• Limit Admin role to 2-3 people per workspace
• Enable audit logging for governance

Power BI Report Server (On-Premises)

For comprehensive Report Server guidance, see `references/report-server-detail.md`. Key facts: requires SQL Server Enterprise SA or Premium license; uses PBIX only (no PBIR); release cycle January/May/September; latest version January 2026.

Fabric Git Integration Updates (2025-2026)

Git integration enhancements since initial GA:

• GitHub support added alongside Azure DevOps Repos (2025)
• Real-time intelligence items (Eventstream, KQL DB, Data Activator) now support Git integration
• Dataflow Gen2 supports CI/CD and Git integration
• Deployment pipelines support Git-triggered automation
• Improved conflict resolution for PBIR-format reports (per-visual file granularity)

Additional Resources

Reference Files

• `references/governance-checklist.md` -- Tenant settings, audit logging, sensitivity labels, data loss prevention, and compliance checklist
• `references/report-server-detail.md` -- Power BI Report Server on-premises: versions, feature comparison, REST API, security, deployment architecture

Power BI Governance Checklist

Tenant Settings (Admin Portal)

Export and Sharing

Content Creation

Developer Settings

Admin API Settings

Audit Logging

Enable Unified Audit Log

1. Microsoft 365 Admin Center > Compliance > Audit 2. Ensure audit logging is turned on 3. Power BI activities are logged automatically

Key Events to Monitor

Querying Audit Logs

PowerShell (Exchange Online):

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) `
    -EndDate (Get-Date) `
    -RecordType PowerBI `
    -ResultSize 5000 |
    Select-Object -ExpandProperty AuditData |
    ConvertFrom-Json |
    Select-Object CreationTime, UserId, Activity, ItemName, WorkspaceName

Power BI Admin API:

GET https://api.powerbi.com/v1.0/myorg/admin/activityevents
    ?startDateTime='2026-01-01T00:00:00Z'
    &endDateTime='2026-01-02T00:00:00Z'

Sensitivity Labels (Microsoft Purview)

Integrate Microsoft Purview Information Protection labels with Power BI:

1. Enable in Admin Portal: Tenant settings > Information protection > Allow users to apply sensitivity labels 2. Label hierarchy: Public < Internal < Confidential < Highly Confidential 3. Downstream protection: Labels propagate from datasets to reports and exports 4. Mandatory labeling: Require labels on all new or edited content 5. Default labels: Set default label for new content

Label Behavior

Data Loss Prevention (DLP)

Configure DLP policies in Microsoft Purview compliance portal:

1. Create DLP policy targeting Power BI workspaces 2. Define rules based on sensitivity labels or sensitive info types (SSN, credit card, etc.) 3. Actions: Show policy tip, restrict access, alert admins 4. Scope: All workspaces or specific workspace groups

Endorsement (Certification and Promotion)

Configure certifiers: Admin Portal > Tenant settings > Certification > Enable certification and specify allowed groups.

Monitoring and Metrics

Power BI Usage Metrics

Built-in usage metrics reports per workspace:

• Report views by user, date, platform
• Most viewed reports
• Active users trend
• Distribution method (direct, app, shared)

Premium/Fabric Capacity Metrics App

Install "Microsoft Fabric Capacity Metrics" app from AppSource:

• CPU utilization by item type
• Overload events and throttling
• Refresh durations and failures
• Query performance trends
• Background vs interactive operations

Custom Admin Dashboard

Build a custom governance dashboard using: 1. Activity Events API for user activity 2. Scanner API for workspace/dataset inventory 3. Admin API for capacity and workspace metadata 4. Store in a data warehouse or lakehouse for historical analysis

Backup and Recovery

XMLA Backup Commands

<!-- Backup -->
<Backup xmlns="http://schemas.microsoft.com/analysisservices/2003/engine">
  <Object>
    <DatabaseID>MySemanticModel</DatabaseID>
  </Object>
  <File>backup.abf</File>
  <AllowOverwrite>true</AllowOverwrite>
</Backup>

<!-- Restore -->
<Restore xmlns="http://schemas.microsoft.com/analysisservices/2003/engine">
  <File>backup.abf</File>
  <DatabaseName>MySemanticModel_Restored</DatabaseName>
  <AllowOverwrite>false</AllowOverwrite>
</Restore>

Note: XMLA backup/restore requires Premium or PPU workspace with XMLA read/write enabled.

Power BI Report Server (On-Premises) - Detailed Reference

Standalone server for organizations that cannot use cloud:

• Deploys .pbix reports, paginated reports (.rdl), KPIs, Excel, mobile reports
• Requires SQL Server Enterprise license with Software Assurance, or Power BI Premium
• Release cycle: January, May, September (three releases per year)
• No real-time Service features (dataflows, apps, streaming, dashboards)
• Gateway not required (data sources are direct from server)

Latest Version: January 2026

Build 1.25.9508.3237 (January 21, 2026):

• Added support for SQL Server 2025 Enterprise Core Product ID
• New advanced server property DisableMSRBConnect (default: True) to restrict Connected mode from Report Builder
• 64-bit only Power BI Desktop for Report Server (starting September 2025, 32-bit deprecated)

Strategic Change: SSRS Consolidation

Starting with SQL Server 2025, Microsoft consolidates all on-premises reporting under Power BI Report Server. No new versions of SQL Server Reporting Services (SSRS) will be released. PBIRS is the default on-premises reporting solution.

Report Server vs. Service Feature Comparison

Report Server REST API

PBIRS exposes a REST API for programmatic management:

Base URL: https://reportserver/reports/api/v2.0/

Report Server Security

Report Server Deployment Architecture

[Users/Browsers] --> [Load Balancer / NLB]
                         |
             +-----------+-----------+
             |                       |
     [PBIRS Instance 1]     [PBIRS Instance 2]
             |                       |
             +-----------+-----------+
                         |
                [Report Server DB]
                (SQL Server)

Scale-out: Multiple PBIRS instances share one Report Server Database. Use NLB or Azure Traffic Manager for traffic distribution.

Upgrade path: PBIRS January 2026 supports in-place upgrade from previous PBIRS versions and migration from SSRS.