PL-300 - Deploy and Maintain Assets (18% of the exam) - Section 4.3

Implement row-level security to restrict data access based on user identity.

Define RLS roles with DAX filter expressions to restrict rows visible to each user, and distinguish static row-level security from dynamic row-level security that uses the USERNAME function to match the signed-in identity against a mapping table. Verify the configuration by testing RLS as specific roles before publishing.

static row-level securitydynamic row-level securityRLS rolesUSERNAME functiontesting RLS

Practice question for this objective

Free sampleDeploy and Maintain Assetsmedium

A modeller wants to add row-level security to a semantic model that uses imported data. Where are RLS roles and DAX filter rules originally defined?

ADefine roles and rules directly in the Power BI service Security page on the semantic model.
BDefine roles and rules in Microsoft Purview Information Protection alongside sensitivity labels.
CDefine roles and rules in Power BI Desktop via the Modeling tab and Manage Roles. Correct
DDefine roles and rules in the Microsoft Entra admin center using directory-scoped groups.

Author RLS roles and DAX rules in Power BI Desktop; assign members in the Power BI service. RLS roles and their DAX filter expressions are authored in Power BI Desktop on the Modeling tab via Manage Roles. The model is then published to the service, where members are added to the roles.

Why A is wrong: The service Security page is for adding members to roles, not for authoring the DAX filter rules themselves.

Why B is wrong: Purview Information Protection governs sensitivity labels, not RLS roles.

Why C is correct: Correct. RLS roles and their DAX filter expressions are authored in Power BI Desktop on the Modeling tab via Manage Roles.

Why D is wrong: Entra ID provides identity for membership; it is not where the DAX filter rules are authored.

See more PL-300 practice questions, answers explained.

Exam traps in Deploy and Maintain Assets

Answers that look right on this material and are not. Each one is a distractor from a different question in the PL-300 bank for this domain.

Yes
Why it is wrong: Trying to enforce column-level rules via RLS DAX filters fails because the model still exposes every column on visible rows.
USERNAME() returns the UPN in Desktop but returns DOMAIN\username in the Power BI service.
Why it is wrong: The directions are reversed; Desktop returns the DOMAIN\user format and the service returns the UPN.
Assign the consumers to the Contributor role on the workspace.
Why it is wrong: Contributors have edit permission for content, so RLS roles do not apply to them; they see all underlying rows.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.