Tableau to Power BI Migration in Financial Services: Access and Provable Numbers
September 4, 2026
In banks, insurers and asset managers a Tableau to Power BI migration rarely breaks on visuals. It breaks on two layers: row-level security, which is rebuilt rather than converted, and the requirement to demonstrate that the numbers still tie out afterwards. Everything between those two layers is the ordinary migration project.
Industry specificity is not a different process, only a tighter set of constraints over the same one. The process is on the migration guide; what follows is the two constraints that set the schedule, plus one decision about the estate you are leaving.
Why row-level security is the first thing to check
Tableau lets access rules sit close to the workbook. Power BI puts them in the semantic model, as roles with DAX filters assigned in the service. The relocation usually reduces the number of rule sets, since reports that each carried a filter end up sharing one model, and it moves ownership, which is the part that surprises people.
| How Tableau restricted access | Power BI equivalent | What to check |
|---|---|---|
| Static user filter with users mapped to values by hand | Role membership assigned in the service | Tableau's own documentation calls manual mapping high maintenance with security that can be tentative; replace it with an entitlements table now |
| Dynamic filter comparing the signed-in user against a security table | A role whose DAX filter uses USERPRINCIPALNAME() | The entitlements table has to be reachable from the model, and the identity string is formatted differently |
| Server groups driving who sees what | Microsoft Entra groups added to roles | Membership administration leaves the BI team and joins identity administration |
| Filter applied to a published data source | Row-level security on the shared semantic model | One model may now serve reports that carried different filters; reconcile before consolidating |
| Hidden or dashboard-level filter used as if it were security | Nothing, because it was never security | The rows stay in the model, and exporting from a visual returns them; the classic first-review finding |
| Certified data sources | Endorsement: Promoted or Certified | The right to certify is granted separately; decide who holds it before publishing |
| Classification stated in the workbook title | Sensitivity labels | Labels travel with exports to Excel, PowerPoint and PDF, so classification survives the platform |
One behavior quietly undoes the whole table. Microsoft documents that row-level security restricts data only for users with Viewer permission: it does not apply to the workspace Admin, Member or Contributor roles. A Tableau habit of granting analysts publishing rights becomes a bypass once those rights turn into workspace membership. Distribute through apps, and keep membership to people meant to see everything.
How to prove the numbers still tie out
Where a figure feeds a control, acceptance is evidence rather than opinion, and evidence has a shape. Agreeing it before conversion keeps sign-off from becoming a negotiation.
| Evidence item | What to record | Why it matters |
|---|---|---|
| Source of truth | The system and query the figure is reconciled against | "It matches Tableau" is no answer if Tableau was never reconciled |
| As-of point | The date and time both sides were read at | Totals move; without a frozen point the comparison is unrepeatable |
| Method | Totals by dimension, row counts, sampled rows, or all three | States what was checked rather than what was glanced at |
| Tolerance | The rounding or aggregation difference accepted, agreed in advance | Stops a penny becoming a week of argument |
| Sign-off | Named person, role and date of acceptance | Acceptance has an owner, and it is not the migration team |
| Retention | Where the artifact is stored and for how long | Evidence nobody can find later is not evidence |
Microsoft treats creating and validating content as one stage for the same reason. Two practices make the evidence hold. Freeze Tableau edits for the reports under validation, since a source changing underneath a comparison invalidates it. And when totals differ, look at semantics before arithmetic: blended sources and many-to-many joins are the usual cause, covered on blending to relationships.
Where the regulated part actually is
It sits in the data and the access path, not in the dashboard. A report page renders a model; what matters upstream is which figure fed which control, who could see which rows, and whether both are demonstrable months later. Power BI provides the controls you map your own policy onto, documented across its security planning guidance: roles, labels, endorsement, audit logging. The obligation stays with your organization.
So the practical version of a regulatory question is the one worth asking early. Not what a rule requires in the abstract, but what your own control owners need to see: which reports feed a control, what evidence they accept for a converted one, and how later changes get recorded. Settle that before conversion and acceptance is administrative; settle it afterwards and it is a renegotiation.
What to do with the legacy Tableau environment
Keep it read-only for a lookback period rather than switching it off on cutover day. Questions about a figure produced under the old system arrive weeks later, and answering from a screenshot is not answering from the report. Freeze editing at cutover so two platforms cannot produce two truths, and budget the seats that window still costs. Its length is a question for your own audit and retention review.
What Antares does in a financial services migration
Antares is a BI migration tool, and the useful part here is the analysis that comes first. The free Analyzer inventories where access logic lives across the estate: which workbooks carry user filters, which published sources carry their own, and where blends will change totals. That turns security rework from a discovery during testing into a scoped task before conversion. It is deterministic, reads metadata only rather than business data, runs inside your own environment, and changes nothing in the source.
The Converter produces a Power BI report page from each source Tableau dashboard at a flat $200, no per-user licensing and no time limit, with LLM costs going to your own provider at typically under $20 per dashboard and private endpoints supported. It is deterministic-first with guardrailed, validated AI steps, flags what it cannot map confidently instead of guessing, and stays like-to-like. Validation and sign-off stay yours, as they should in a controlled process. We make no claims about certification or regulatory status: bring the technical facts to your own security review. Run the free Analyzer to see where the access rules are before planning the rebuild.
Related reading: the migration risk register, migrating without touching patient data and the Analyzer. Primary sources: Microsoft on row-level security and sensitivity labels, plus Tableau on row-level security options.
← Back to the Tableau to Power BI Migration guide
Related Migration Resources
Frequently asked questions
Do Tableau user filters convert automatically into Power BI row-level security?
No. Tableau applies user filters at workbook or data source level; Power BI defines roles with DAX filters inside the semantic model and assigns membership in the service. The logic is rebuilt rather than translated. What automation helps with is scope: an analysis pass tells you which workbooks and sources carry filters before anyone starts rebuilding them.
Does Power BI row-level security apply to everyone with workspace access?
No, and this is the most common finding of a first security review. Microsoft documents that row-level security restricts data only for users with Viewer permission; it does not apply to the workspace Admin, Member or Contributor roles. Distribute content through apps and viewer roles, and keep workspace membership to people meant to see everything.
What evidence should we keep when validating a converted report?
Six things: the source of truth the figure was reconciled against, the as-of date and time both sides were read at, the comparison method, the tolerance agreed in advance, a named sign-off with a date, and where the artifact is stored and for how long. Agree that list before conversion starts rather than at acceptance.
What should our security review ask about a migration tool?
Four technical questions: whether it reads business data or only metadata, where it runs, where any model calls go and whether private endpoints are supported, and whether anything in the source environment is modified. For Antares the answers are metadata only, inside your own environment if you choose, your own private LLM endpoints, and nothing changed in the source. We make no claims about certification or regulatory status; that assessment belongs to your review.