Certified vs uncertified Power BI custom visuals: what certification checks and unlocks
By Nawaf Sharaf · Founder & Reliability Engineer · Updated
A certified Power BI visual is a Marketplace visual whose code Microsoft's Power BI team has tested and approved[3]. Certification isn't a quality rating: it's a security and compliance gate, and it unlocks three things nothing else can, namely PDF export, PowerPoint export and rendering in subscription emails.
The difference, line by line
| Scenario | Certified | Uncertified |
|---|---|---|
| Renders in the service when the SDK visuals setting is on[2] | Yes | Yes, unless certified-only mode is on |
| Certified-only tenants[2] | Allowed | Error, unless in the org store |
| Export to PDF[8] | Supported | Not supported |
| Export to PowerPoint[7] | Supported | Not supported |
| Email subscriptions[9] | Rendered | Error symbol |
| Can be added to the organizational store[5] | Yes (From AppSource keeps certification) | Yes (From a file or AppSource) |
| Who can have it[5] | Marketplace-listed visuals only | Any visual |
Both kinds still need “Allow visuals created using the Power BI SDK” switched on, or the organizational store, to render in the service. The uncertified visuals guide lists every switch.
What Microsoft tests
According to the Power BI visuals FAQ, certification testing includes code reviews, static code analysis, data leakage, data fuzzing, penetration testing, access XSS testing, malicious data injection, input validation and functional testing[5].
Code rules for certified visuals
The certification page sets out what the package and its repository must contain[3]:
- Approved in Partner Center (publish to the Marketplace first); not an R visual; the compiled package must exactly match the submitted one.
- A repository (branch
certification) with .gitignore, capabilities.json, pbiviz.json, package.json (with typescript, eslint and eslint-plugin-powerbi-visuals), package-lock.json and tsconfig.json, matching the submitted package. npm install,pbiviz package,npm audit(no high or moderate warnings) and ESLint must all pass.- Built with the latest visuals API and the latest powerbi-visuals-tools.
- Only public, reviewable open-source components; the Rendering Events API; sanitized DOM content; a sample report.
Not allowed
- Accessing external services or resources: the WebAccess privilege must be empty or omitted.
- XMLHttpRequest and fetch.
- innerHTML, or D3 .html(), with user or data input.
- Dynamic code: eval(), unsafe uses of setTimeout(), requestAnimationFrame(), setInterval() with user input, or the Function constructor.
- JavaScript errors or exceptions in the browser console, for any input data.
- Minified JavaScript in the repository.
From powerbi-visuals-tools 6.1.0, pbiviz package --certification-audit flags fetch, XMLHttpRequest and eval in your code, and --certification-fixremoves them; Microsoft intends the fix only for calls inside third-party libraries you don't control[3].
How a vendor gets certified
- Get the visual approved in Partner Center; Microsoft recommends publishing it to the Microsoft Marketplace (formerly AppSource) before requesting certification.[3]
- In Partner Center, choose the visual on the Overview page, go to Product setup and select the Request Power BI certification check box.[3]
- On the Review and publish page, use Notes for certification to give the source-code link and credentials (for a private repository, also recovery codes and read-only access for Microsoft's pbicvsupport account).[3]
- Wait for review: up to four weeks for a first certification, up to three for an update.[5]
- After approval the badge appears within about three weeks.[3]
How to tell if a visual is certified
- In Power BI's Get more visuals, certified visuals carry a blue Certified badge[3].
- On Microsoft Marketplace (formerly AppSource), the listing shows a yellow badge, and you can filter on “Power BI Certified”[3]. The VizForge custom visual directory also lists certification for notable Marketplace visuals.
- A .pbiviz file can't prove it either way. You can check what it requests and whether its code uses the forbidden calls with the pbiviz Inspector, but certification is a property of the listing.
Where VizForge visuals stand
Plainly: VizForge visuals are uncertified, like every private .pbiviz. We don't call them “certification-ready” either: certification needs a Marketplace listing, a reviewable repository and a clean --certification-auditrun, and we don't run that audit on every build.
What the generator does do, because tenant reviews ask for it: its capabilities templates declare an empty privileges list (no WebAccess), the build's checks reject innerHTML/outerHTML in the visual's own code (bundled libraries such as d3 may still contain them) and require renderingStarted/renderingFinished (renderingFailed isn't enforced yet), and you get the full TypeScript source. That's what makes the organizational store route straightforward. Keep VizForge visuals off pages you export to PDF or PowerPoint or send as subscriptions.
More on what a .pbiviz can access: are Power BI custom visuals safe?
FAQ
Can a private or in-house visual be certified?
No. Certification is a Marketplace process: the visual must be published to the Microsoft Marketplace through Partner Center before you can request it. A private .pbiviz stays uncertified; the organizational store is how tenants allow it.
How long does certification take?
Microsoft says a first-time certification can take up to four weeks and an update up to three. After approval the badge can take up to three weeks to show, and a new Marketplace visual takes a few hours to list plus 10–14 days to reach Desktop and the service.
Is a certified visual guaranteed to be safe?
Certification means Microsoft's team ran its tests, which are designed to check that the visual doesn't access external services or resources. Microsoft also notes it isn't the author of third-party visuals and advises contacting the author to verify how a visual works. Equally, uncertified doesn't mean unsafe.
Does a certified visual stay certified in the organizational store?
Yes, when the admin adds it From AppSource: it keeps its certification, including export to PDF and PowerPoint, and updates automatically. Uploading the same visual as a file doesn't carry the certification with it.
Can maps or visuals with commercial libraries be certified?
Microsoft's certification page says visuals that need external services (such as map visuals) or rely on commercial libraries can't be certified, because certified visuals may only use public, reviewable open-source code and no external access.
Sources
Microsoft Learn pages, read as of Nov 2026. The date is the page's own “last updated” stamp at the time.
- [2]Manage Power BI visuals admin settings (organizational visuals)(opens in a new tab)Microsoft Learn · revised Sep 1, 2026
- [3]Certified Power BI visuals (requirements and process)(opens in a new tab)Microsoft Learn · revised Dec 15, 2025
- [4]Power BI organizational visuals: considerations and limitations(opens in a new tab)Microsoft Learn · revised Dec 15, 2025
- [5]Power BI custom visuals FAQ(opens in a new tab)Microsoft Learn · revised Dec 4, 2025
- [7]Export a report to PowerPoint(opens in a new tab)Microsoft Learn · revised Dec 1, 2025
- [8]Export a report to PDF(opens in a new tab)Microsoft Learn · revised May 30, 2026
- [9]Email subscriptions for reports and dashboards(opens in a new tab)Microsoft Learn · revised Oct 9, 2026
Need a custom visual for interactive pages?
VizForge generates the visual from a plain-English brief, with source code and no network privileges, for your admin to approve through the organizational store. It won't be certified, so pair it with built-in visuals on exported pages.
Generate a custom visual with AI · starts free →