PL-300 manage and secure Power BI explained
Manage and secure Power BI is worth 15–20% of PL-300. It covers what happens after the report is built: creating workspaces, publishing and distributing content, keeping data fresh, and controlling who can see what. It is the smallest domain, but its questions are among the most predictable, because they test rules that have one right answer.
Create and manage workspaces and assets
Workspace roles
| Role | Can do |
|---|---|
| Admin | Everything, including managing the workspace and all access |
| Member | Edit content, publish and update the app, and add people with equal or lower roles |
| Contributor | Create, edit and delete content and publish to the workspace; cannot manage access |
| Viewer | View and interact with content; cannot edit |
A person who must edit reports but not manage access is a Contributor. A person who only consumes reports is a Viewer. Know the boundaries between neighbouring roles, as questions are built on them.
Distribution
| Method | Use when |
|---|---|
| Workspace access | The people also work on the content |
| App | You want to give many consumers a curated set of reports and dashboards, with audiences |
| Sharing a report or item | You want to share one item with a person or group |
| Subscriptions | Users want an emailed snapshot on a schedule |
| Data alerts | You want a notification when a dashboard tile crosses a threshold |
Apps are the standard answer when a large group of consumers needs read-only content without workspace access. A dashboard is a single page of pinned tiles from one or more reports, and is created in the service. Data alerts work on tiles such as cards, KPIs and gauges.
Publishing, refresh and gateways
You publish from Power BI Desktop, import a file, or update an existing item. A semantic model can refresh on a schedule in the service. A gateway is needed when the service must reach a source that is not directly reachable from the cloud, such as an on-premises SQL Server. Cloud sources do not normally need one. Credentials must also be configured for refresh to succeed.
Endorsement
| Level | Who can set it | Meaning |
|---|---|---|
| Promoted | Anyone with write permission on the item | The owner recommends it |
| Certified | Only people authorised by the tenant admin | It meets the organisation’s quality standard |
Secure and govern Power BI items
Access to items
Workspace roles apply to everything in the workspace. Item-level access lets you grant access to one report, dashboard or semantic model. Build permission on a semantic model allows people to create their own reports from it. Giving viewers an app or item permission is usually better than adding them to the workspace.
Row-level security
RLS restricts which rows a user can see in a semantic model. You create roles in Desktop, each with a DAX filter on a table, then add members in the service.
| Type | Filter | Use for |
|---|---|---|
| Static | [Region] = "West" | A fixed set of users per role |
| Dynamic | [Email] = USERPRINCIPALNAME() | One role, user-specific rows from a mapping table |
Three facts decide most RLS questions. Members of a role are assigned in the service, not just in Desktop. Users with Admin, Member or Contributor rights in the workspace bypass RLS, so the people it should restrict must be Viewers or use an app. And filters flow along relationships, so a filter on a dimension also restricts the fact table.
Sensitivity labels
Sensitivity labels from Microsoft Purview classify and protect content. They are applied to items and can follow exported data. They label data; they do not control who sees which rows.
Sample questions
Question 1. A semantic model imports data from a SQL Server in the company datacenter. Refresh works in Power BI Desktop but the scheduled refresh in the service fails because the source cannot be reached. What do you need?
- A. Switch the model to DirectQuery
- B. Apply a sensitivity label
- C. Install and configure an on-premises data gateway
- D. Certify the semantic model
Show answer
Answer: C
The service cannot reach an on-premises source directly. An on-premises data gateway provides the connection, and you then map the source to it and set credentials. DirectQuery would still need a path to the source. Sensitivity labels and certification do not affect connectivity.
Want more questions like this? Full PL-300 practice tests →
Question 2. An analyst must create and edit reports and semantic models in a workspace and publish from Power BI Desktop, but must not be able to manage who has access to the workspace. Which role should you assign?
- A. Admin
- B. Contributor
- C. Viewer
- D. Member
Show answer
Answer: B
Contributor can create, edit and delete content and publish to the workspace without managing access. Admin can manage everything. Member can additionally add people and update the app. Viewer cannot edit content.
Want more questions like this? Full PL-300 practice tests →
Question 3. You want to mark a semantic model so users know it is the trusted source, and only reviewers authorised by the tenant admin should be able to apply that mark. What should you use?
- A. Certify the semantic model
- B. Promote the semantic model
- C. Apply a sensitivity label
- D. Create a subscription
Show answer
Answer: A
Certification can be applied only by users the tenant admin has authorised, so it signals a reviewed, trusted item. Promotion can be applied by anyone with write permission. A sensitivity label classifies data and does not signal trust. A subscription emails a report snapshot.
Want more questions like this? Full PL-300 practice tests →
What to practise
Publish a report to a workspace. Add three test accounts as Admin, Contributor and Viewer and compare what each can do. Create an RLS role, add a user as a Viewer, and use View as. Then add the same user as Contributor and see the filter disappear. Create an app with two audiences, set up a scheduled refresh, and add a data alert on a dashboard tile.