# Session 5 Handout: Share Safely and Present

<p class="meta">FAST-11 AI-Assisted Analytics and Business Intelligence · 7formations · Instructor: Wadood Chaudhary · All examples fictional</p>

## Why this session matters

A correct dashboard shared with the wrong people is a data incident. AI features make this sharper: Copilot can answer questions from anything a user can access. Sharing well means the right audience, least privilege, row-level filtering where needed, labels that travel with exports, and knowing when the data was last refreshed.

## Key concepts

### 1. Permissions vs. labels (Power BI)

| Control | What it does |
| --- | --- |
| **Workspace roles, app audiences, sharing** | Decide **who can see** content in the service |
| **Row-level security (RLS)** | Filters **which rows** each viewer sees, by role |
| **Sensitivity labels** (Microsoft Purview) | **Classify** content; label and encryption **travel with supported exports** (Excel, PowerPoint, PDF, .pbix) |

In the service, a label does not by itself block access; permissions do. **RLS applies to Viewers.** Workspace Admins, Members, and Contributors see all rows, so give most readers Viewer access or an app. Test with "View as."

Tableau: use project and site permissions and row-level data policies or user filters; Pulse metrics follow the data source's permissions.

### 2. Refresh

AI answers come from the data **as of the last refresh**. Show the last refresh time on the page; check it before quoting a number.

### 3. Sharing checklist (W5)

1. Classify: personal or confidential data? Label.
2. Audience: who, to do what?
3. Access: Viewer or app; no edit for readers.
4. Rows: RLS needed? Tested?
5. Exports: label applies; export settings appropriate.
6. Refresh: scheduled; last refresh visible.
7. Public links: none.

### 4. Presenting the capstone (5 minutes)

Question → answer with one number → how you verified it → dashboard → data story → sharing setup → decision needed.

## Worked example (fictional)

Pioneer Valley Mutual's renewal report: Confidential label; six agents get Viewer access through an app with an RLS role by agent (tested as two agents); the principal is workspace Admin; the marketing contractor gets no copy, only an aggregated table with no names if the principal approves; no "publish to web"; refresh nightly with the time shown.

## Do and don't

| Do | Don't |
| --- | --- |
| Share with the smallest audience that needs it | Add everyone as Members |
| Test RLS and Copilot as a viewer | Assume filters protect data |
| Give aggregates to outsiders | Send a .pbix with names |
| Show last refresh | Quote stale numbers |