Data Inventory
This page lists, in one place, the data that leaves your tenant when you use BI Pixie. For each way you can run BI Pixie, it says where the data goes, how long it stays, and which setting turns it off. The last section lists the hostnames to allow through a proxy or firewall.
BI Pixie records how reports are used, not the data inside them. BI Pixie collects viewer user names only when you turn on Capture user identity, and until then it counts viewers by a masked IP address. When you turn it on, you choose on the Account page whether BI Pixie keeps each viewer's email address, a masked ID or nothing. Filtered values are recorded only when you turn them on, and client IP addresses are masked when they arrive.
Everything on this page is live today unless it is marked Coming. A Coming item describes work that is designed or in review but not yet available.
Choose your setup
- What a usage event contains (every setup)
- BI Pixie Cloud
- Fabric Workload with BI Pixie storage
- Fabric Workload with OneLake delivery
- Self-hosted on Azure or Power Platform
- Services that receive data
- Hostnames and fixed addresses to allow
What a usage event contains
When you add Pixies to a report, the report sends a small usage event each time a viewer opens a page, selects a visual, applies a filter or answers a survey. The fields are the same in every setup. Only where they are stored changes.
| Field | When it is sent | Setting that turns it off |
|---|---|---|
| Workspace, report, page name and page number, event type, time | Always. | The page name is replaced with "Page N" when you turn off page names in Tracking Setup. The other fields are what make an event an event. |
| Visual type, visual name, bookmark name | Visual names are sent when heatmaps are on. Bookmark names are sent when a viewer selects a bookmark. | Turn off heatmaps in Tracking Setup. |
| Viewer name (user principal name or custom data) | Only when you turn it on. Off by default. | Leave viewer names off in Tracking Setup. A viewer who chooses to stay anonymous in a survey is never named. |
| Filtered column name and filtered values | Only when you turn them on. Off by default. Filtered values are cut to 20 characters by default, and to at most 500. | Leave filtered values off in Tracking Setup. The number of distinct filtered values is always sent. |
| Client IP address | Read from the request, or from the Pixie's address when one is passed there. Either way it is masked when it arrives, before it is stored. | Masked in BI Pixie Cloud and the Fabric Workload. In self-hosted, masking is on by default and the setting is in your own Function App. |
| Browser user agent | Always, from the request. | No setting. |
| Feedback score and comment | When a viewer answers a feedback prompt or a survey. | Turn off feedback and surveys in Tracking Setup. |
| Report inventory and performance timings | When Pixies are added to a report, and when performance tracking is on. | Turn off performance tracking in Tracking Setup. The inventory is part of adding Pixies. |
When viewer names are on, the viewer name also forms part of the folder in which that viewer's events are stored.
When an event cannot be received, BI Pixie's monitoring logs record the kind of error and never the event itself. Viewer names, filtered values and IP addresses are not written to those logs.
Coming: a Viewer identity setting in BI Pixie Cloud and the Fabric Workload, which lets an admin store viewer names as they are, store them as a keyed mask that BI Pixie cannot turn back into a name, or not collect them. The masking is in place today. The setting is not yet on either screen.
BI Pixie Cloud
In BI Pixie Cloud, BI Pixie keeps your data in its own Azure, in a storage container that belongs to your license alone. BI Pixie places it in East US 2 or West Europe, whichever is closer to your Power BI home region. Data is encrypted in transit with TLS 1.2 or later and at rest with AES-256.
| Data | Where it goes | How long it stays | Setting that turns it off or shortens it |
|---|---|---|---|
| Usage events in transit | BI Pixie's event processing in your region. | Up to 7 days, while they are processed. | Remove Pixies from a report to stop its events. |
| Usage events | Your license's storage container. | Up to your plan's retention: 14 days on a trial, 30 days on the Free and Standard plans, 1 year on the Pro plan, 3 years on the Enterprise plan. Retention is subject to your monthly session allowance: if usage reaches the ceiling far above that allowance and your account is set to keep collecting, the oldest events are removed first. Expired events are deleted every day. | Data Management, Retention: choose a shorter window, down to 7 days. Data Management can also delete one report's or one viewer's events. |
| Events you delete in Data Management | A recovery copy in BI Pixie's storage. | Up to 90 days, then deleted. | No setting. |
| A record that a viewer's events were deleted: a one-way hash of the folder BI Pixie kept their events in, and the time of the deletion | Your license's storage container. If you have the BI Pixie Dashboard, its lakehouse also keeps a list of the deletions it has applied. | As long as your license's storage is kept. The record is what keeps the deleted viewer out of the dashboard when its tables are rebuilt. | No setting. |
| Copies of reports and semantic models that BI Pixie changed | BI Pixie's storage, kept so support can help if a change needs to be undone. | 30 days. | Coming: a Keep no copy choice. |
| Semantic model structure sent for an AI Readiness assessment (table and field names, descriptions, AI instructions) | BI Pixie's storage, while the assessment runs. | 7 days. | Do not run an assessment. |
| AI Readiness and benchmark results, including the questions asked and the data agent's answers | Your license's storage container. | Until you delete them or close your account. | Delete them from the AI Readiness registry. |
| Working files from a benchmark run (the questions, the data agent's raw answers, and the rows of your data used to check them) | Your license's storage container. | Deleted together with the run's result. The working files of a run that never produced a result are deleted once they have been untouched for 14 days. BI Pixie checks for them every day. When you stop a benchmark after questions were asked, BI Pixie keeps it in the benchmark history as a cancelled run, with the semantic model, the data agent, the time and the number of questions asked, until you delete all of that semantic model's benchmark results. All of them are deleted when you close your account. | Delete the result from the AI Readiness registry. |
| Report inventory (report names and the date Pixies were first added) | Your license's storage container. | Until you close your account. The dashboard needs the first date. | No setting. |
| Tracking Setup and report configuration | BI Pixie's storage. | Until you close your account. | No setting. |
| Session counts (date, workspace and report names, and a hash of the viewer name, or of the masked IP address when no name is sent) | BI Pixie's storage, used to count your sessions. | 90 days. | No setting. Session counts are recorded in every setup that BI Pixie hosts. |
| Account records (your organization's name, Microsoft Entra tenant ID, and each member's email address, name and role) | BI Pixie's account records. | While your account exists. When you close your account, your data and members are removed, and a closed-account record of the organization name, tenant ID and owner's email address is kept. | Remove a member in Team Management. |
| Audit log of changes made in your account | BI Pixie's account records. | Until your account is deleted. | No setting. |
| Service email sent to you (recipient, subject, delivery status) | BI Pixie's account records. | Until BI Pixie deletes the log. | No setting. |
| Your own OpenAI, Anthropic or Azure OpenAI key, if you connect one | BI Pixie's account records, encrypted with a key held in Azure Key Vault. It is never shown again after you save it. | Until you remove it. | Remove the key in AI Assistants. |
When you close your account, BI Pixie deletes your storage containers. Deleted files remain recoverable by BI Pixie for 14 days and are then gone.
Fabric Workload with BI Pixie storage
When you run BI Pixie inside Microsoft Fabric and keep the default storage, everything in the BI Pixie Cloud table applies unchanged. Two things differ, and both stay in your Fabric tenant.
| Data | Where it goes | How long it stays | Setting that turns it off |
|---|---|---|---|
| The BI Pixie Dashboard and its semantic model | Your Fabric workspace. It reads your usage events from your BI Pixie storage container with read-only access. | Until you delete it from your workspace. | Do not install the dashboard, or delete it. |
| The BI Pixie data agent | Your Fabric workspace, running on your capacity. | Until you delete it. | It is installed only when you select Install Data Agent. |
Fabric Workload with OneLake delivery
With OneLake delivery, BI Pixie delivers your usage events to a lakehouse in your own Fabric workspace, and keeps your AI Readiness and benchmark results there too. BI Pixie writes to your lakehouse with a credential issued in your tenant, so no secret is stored. See Data Residency (OneLake) to turn it on.
| Data | Where it goes | How long it stays | Setting that turns it off or shortens it |
|---|---|---|---|
| Usage events in transit | BI Pixie's event processing, then a delivery buffer in BI Pixie's storage in your region. | Up to 7 days in event processing. In the buffer, usually under a minute, and each event is deleted from the buffer as soon as your lakehouse accepts it. | Remove Pixies from a report to stop its events. |
| Usage events your lakehouse cannot accept | The delivery buffer, retried for 72 hours. | After 72 hours, it depends on your choice. Delete undelivered events (the default) deletes them. Keep undelivered events keeps them for the number of days you chose, from 1 to 30 and 30 by default. BI Pixie delivers them if delivery recovers within that time, and deletes each one that reaches the limit. Every admin of your BI Pixie account receives an email two days before deletion starts. | Data Residency, "If delivery fails for more than 72 hours" when you turn delivery on, and the Undelivered events tile afterwards. Both let an admin choose deletion, or 1 to 30 days. |
| Usage events, inventory and performance timings | Your lakehouse. | As long as you keep them. You manage your lakehouse. | Your own lakehouse policies. |
| AI Readiness and benchmark results | Your lakehouse. If your lakehouse cannot be reached, a result waits in the delivery buffer. | A waiting result is deleted after 7 days. | Your own lakehouse policies. |
| Copies of reports and semantic models that BI Pixie changed | No support copy is kept when Pixies are added directly. A file you choose to download waits in BI Pixie's storage for you. | A download is deleted after 1 day. | No setting. |
| License status, Tracking Setup and report configuration | BI Pixie's storage. | Until you close your account. | No setting. |
| Session counts, account records, audit log and service email | BI Pixie's storage and account records, as in the BI Pixie Cloud table. | As in the BI Pixie Cloud table. Session counts are kept 90 days. | As in the BI Pixie Cloud table. |
The delivery buffer sits in the same BI Pixie storage that keeps deleted files recoverable for 14 days, so BI Pixie can recover an event for up to 14 days after it is deleted from the buffer. That is the longest it can be. BI Pixie is moving the events it keeps after 72 hours of failed delivery into separate storage where a deletion is final, and an event deleted there cannot be recovered at all.
Self-hosted on Azure or Power Platform
With self-hosted BI Pixie, the services that receive and store your usage events run in your own Azure subscription or Power Platform environment. BI Pixie has no access to them. Usage events, inventory and performance timings never reach BI Pixie. The only data that leaves your tenant for BI Pixie is the license check.
| Data | Where it goes | How long it stays | Setting that turns it off |
|---|---|---|---|
| Usage events in transit (Azure) | Event Hubs in your subscription. | 1 day by default. You can set 1 to 7 days. | Your Event Hubs settings. |
| Usage events, inventory and performance timings (Azure) | Your Azure Data Lake Storage account, in the bipixielake container. | Until you delete them. BI Pixie sets no automatic deletion. | Your own storage lifecycle rules. |
| Usage events (Power Platform) | Your Power Platform environment. | Until you delete them. | Your own environment policies. |
| Monitoring logs (Azure, optional) | Application Insights in your resource group. | Your workspace's retention. | Leave monitoring off when you deploy. |
| License check from the desktop tool: your license key, your subscription email, and the name and page count of each report it adds Pixies to | A BI Pixie license service hosted on Azure Logic Apps, each time the tool runs. | The license service's run history, which Azure keeps for up to 90 days. | No setting. The tool does not run without it. No report content, viewer data or usage events are sent. |
| License check from the BI Pixie Dashboard: your license key, your subscription email, and the number of reports and viewers it counted | A BI Pixie license service hosted on Microsoft Power Automate, each time the dashboard refreshes. | The license service's run history. | No setting. Only counts are sent, never names. |
Encrypt with your own key (Azure)
From version 1.1.0 of the Azure deployment, you can encrypt BI Pixie's storage in your subscription with a key you hold in your own Azure Key Vault. It covers both storage accounts the deployment creates, and can also cover Event Hubs, which then runs on the Premium tier. You choose it when you deploy. It cannot be added to an existing deployment. If you disable the key, BI Pixie stops recording new events until you enable it again. See Deploy on Azure.
Self-hosted storage with the Fabric Workload or BI Pixie Cloud
If you also use the Fabric Workload or BI Pixie Cloud with your self-hosted storage, you can grant BI Pixie read access to your storage container, either through your own Microsoft Entra app or with a shared access signature that lasts at most 90 days. BI Pixie uses it to show your data and to run Data Management. It never changes your storage settings, and it deletes events only if you grant delete permission. A shared access signature is kept encrypted in BI Pixie's account records until you remove it. See Bring Your Own Storage.
Coming
- A new license check for the desktop tool, answered by BI Pixie with a signed reply. It sends the same license key, subscription email, report names and page counts, and adds the version of the tool, the identity you sign in with, and a one-time value that prevents replay. BI Pixie keeps the list of report names for the life of your license.
- Private network options, so that your self-hosted services can be reached only from your own network.
Services that receive data
These services receive data from BI Pixie Cloud and the Fabric Workload. None of them receives usage events.
| Service | What it receives | When |
|---|---|---|
| Microsoft Azure | Everything in the tables above that BI Pixie stores. BI Pixie runs on Azure. | Always. |
| Azure Communication Services Email, in the United States | Recipient address and message content for the service email BI Pixie sends you. | When BI Pixie emails you. |
| Stripe | The billing email address, the plan and billing cycle, and your Microsoft Entra tenant ID for some subscriptions. | When you subscribe or change a paid plan. |
| HubSpot | Your name, email address, company and job title, your plan, the service email BI Pixie sends you, and any support request with its attachments. | When you sign up, contact BI Pixie or open a support request. |
| OpenAI, Anthropic or your Azure OpenAI resource | Semantic model table and field names, descriptions and DAX. When BI Pixie drafts AI instructions, also the most-used fields and the words seen in your reports, which can include filtered values if you turned them on. | Only when an admin on the Pro or Enterprise plan connects your own key, and then only for the AI Readiness actions you start. |
| Your Fabric data agent | Benchmark questions. | When you run a benchmark. It runs on your capacity, in your tenant. |
Hostnames and fixed addresses to allow
If a proxy or firewall controls what your users and services can reach, allow these hostnames over HTTPS on port 443.
| Hostname | Used by | Setup |
|---|---|---|
api.bipixie.com | Report viewers' browsers, which send usage events, and the BI Pixie API. | BI Pixie Cloud and the Fabric Workload |
app.bipixie.com, func-pixie-ctl-prod-eastus2.azurewebsites.net | People who use the BI Pixie Cloud portal. Their browser loads the portal from the first hostname and sends every request for your data to the second. Both are needed: with only the first allowed, the portal opens and shows no data. | BI Pixie Cloud |
workload.bipixie.com, ctl.bipixie.com | People who open BI Pixie inside Fabric. Their browser loads BI Pixie from the first hostname and sends every request for your data to the second. Both are needed. | Fabric Workload |
stpixieintprodeastus2.blob.core.windows.net, stpixieintprodweu.blob.core.windows.net | People who download a report file after BI Pixie adds Pixies to it. Their browser fetches the file from BI Pixie's storage in your BI Pixie region. The first hostname is East US 2 and the second is West Europe, and you need only the one for your region. A region that BI Pixie sets up at your request has a hostname of its own, which support can give you. | BI Pixie Cloud and the Fabric Workload |
checkout.stripe.com, billing.stripe.com | People who pay for a plan by card, or who manage that payment. Stripe hosts those two pages, and each one loads from further Stripe hostnames that Stripe publishes. | BI Pixie Cloud and the Fabric Workload, when you pay by card |
login.microsoftonline.com | Signing in with your Microsoft account. | Every setup |
| Your own Function App hostname | Report viewers' browsers, which send usage events to your deployment. | Self-hosted on Azure |
bipixie.com, ghcr.io | Your deployment, which downloads BI Pixie's code from bipixie.com and, if you choose the MCP server, its container image from ghcr.io. | Self-hosted on Azure |
*.logic.azure.com | The desktop tool's license check. | Self-hosted |
The table lists BI Pixie's own hostnames and the outside services that people reach directly. BI Pixie also relies on Microsoft's hostnames. The sign-in page loads parts of itself from further Microsoft hostnames, and inside Fabric a person's browser calls api.fabric.microsoft.com and api.powerbi.com for BI Pixie. An organization that already uses Microsoft 365, Power BI and Fabric through the same proxy allows these today, and Microsoft publishes the full lists.
Fixed addresses for OneLake delivery. BI Pixie delivers to your lakehouse from one fixed outbound IP address in each BI Pixie region. If a Microsoft Entra Conditional Access policy restricts where OneLake can be reached from, add that address to it. Contact support for the address of your region. When your lakehouse is in the same Azure region as BI Pixie, the traffic may reach OneLake without passing through that address.
BI Pixie Cloud and the Fabric Workload use no other fixed addresses. Self-hosted services use the addresses of your own Azure subscription.