Managing RLS in Service in Power BI - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding RLS Role Assignments in Power BI Service

In Power BI Service, you have created a role with a DAX filter to restrict data by region. You want to assign users to this role so they only see data for their region.

Which method correctly assigns users to the RLS role in Power BI Service?

A Go to the dataset's security settings in Power BI Service and add users to the role by their email addresses.

B Edit the Power BI Desktop report and add users to the role under the Modeling tab before publishing.

C Share the report link with users; RLS roles are automatically assigned based on their Azure AD group.

D Create a new workspace and add users as members; RLS roles apply automatically to workspace members.

💡 Hint

Think about where user-role assignments are managed after publishing the dataset.

In Power BI Service, RLS roles are assigned by going to the dataset's security settings and adding users or groups to the roles defined in Power BI Desktop. This controls data access for those users.

❓ dax_lod_result

intermediate

DAX Filter Behavior in RLS Role

Given a table 'Sales' with columns 'Region' and 'SalesAmount', you define an RLS role with this DAX filter:

Sales[Region] = USERPRINCIPALNAME()

If a user with email '[e-mail]' logs in, what will be the result of this DAX query?

EVALUATE FILTER(Sales, Sales[Region] = USERPRINCIPALNAME())

A Returns no rows because Sales[Region] contains region names, not emails.

B Returns all rows where Sales[Region] equals the user's display name.

C Returns all rows because USERPRINCIPALNAME() is ignored in RLS filters.

D Returns all rows where Sales[Region] equals '[e-mail]'.

💡 Hint

Consider the data type and values in the 'Region' column compared to USERPRINCIPALNAME() output.

USERPRINCIPALNAME() returns the user's email. If 'Region' contains region names like 'North', comparing it to an email will never match, so no rows are returned.

🔧 Formula Fix

advanced

Diagnosing RLS Not Applying in Power BI Service

You published a Power BI report with RLS roles defined and assigned users in Power BI Service. However, users report they can see all data, ignoring RLS filters.

Which of the following is the most likely cause?

A The dataset is in a Premium workspace, so RLS does not apply.

B The users are workspace admins or members with Build permission, which bypasses RLS.

C The RLS roles were not published from Power BI Desktop to the Service.

D The users are accessing the report via a shared dashboard, which disables RLS.

💡 Hint

Think about permissions that override RLS in Power BI Service.

Users with workspace admin or member roles with Build permission can bypass RLS filters and see all data. Assigning users only as viewers enforces RLS.

❓ visualization

advanced

Visualizing RLS Impact on Report Output

You have a report page showing total sales by region. RLS is applied to restrict users to their own region.

Which visualization best helps users understand their restricted data view?

A A pie chart showing sales for all regions, but grayed out for regions outside the user's access.

B A map visualization showing all regions, but with tooltips disabled for restricted regions.

C A table listing all regions with sales, but rows outside the user's region are blank.

D A bar chart showing sales by region, with only the user's region bar visible.

💡 Hint

Consider clarity and avoiding confusion about data visibility.

Showing only the user's region in a bar chart clearly communicates the data they can access without confusion from hidden or blank data for other regions.

🎯 Scenario

expert

Implementing Dynamic RLS for Multiple User Groups

Your company has multiple departments: Sales, Marketing, and Finance. You want to implement RLS so that users see data only for their department. User department info is stored in an Azure AD group membership.

Which approach correctly implements dynamic RLS in Power BI Service?

A Create one RLS role per department in Power BI Desktop, assign users to roles in Power BI Service based on their Azure AD group membership.

B Assign all users to a single RLS role and rely on workspace permissions to restrict data access by department.

C Create a single RLS role with a DAX filter using USERPRINCIPALNAME() to lookup department in a mapping table imported into the model.

D Use Azure AD security groups directly in the Power BI Desktop DAX filter expression to filter data by department.

💡 Hint

Think about how to make RLS dynamic and scalable for many users and departments.

Using a mapping table with USERPRINCIPALNAME() in a single RLS role allows dynamic filtering based on user identity, which is scalable and maintainable.

Practice

1. What is the primary purpose of Row-Level Security (RLS) in Power BI Service?

easy

A. To change the report layout based on user preferences

B. To improve report loading speed by caching data

C. To create new data columns dynamically in reports

D. To restrict data access so users see only data they are allowed to view

Solution

1. Step 1: Understand RLS purpose

   RLS is designed to limit data visibility for different users based on roles.

2. Step 2: Identify correct purpose in options

   Only To restrict data access so users see only data they are allowed to view describes restricting data access to authorized users.

3. Final Answer:

   To restrict data access so users see only data they are allowed to view -> Option D

4. Quick Check:

   RLS controls data visibility = D [OK]

Hint: RLS controls who sees what data in reports [OK]

Common Mistakes:

• Confusing RLS with report performance features
• Thinking RLS changes report design
• Assuming RLS creates new data columns

2. Which step must be done in Power BI Service after defining roles in Power BI Desktop to enforce RLS?

easy

A. Assign users or groups to the defined roles

B. Create new calculated columns for roles

C. Publish the report again without changes

D. Change the data source credentials

Solution

1. Step 1: Recall RLS workflow

   After defining roles in Desktop, you must assign users to those roles in Service.

2. Step 2: Match correct action in options

   Only Assign users or groups to the defined roles describes assigning users to roles, which activates RLS.

3. Final Answer:

   Assign users or groups to the defined roles -> Option A

4. Quick Check:

   Assign users to roles in Service = A [OK]

Hint: Assign users to roles in Service to activate RLS [OK]

Common Mistakes:

• Thinking you must create columns for RLS in Service
• Assuming republishing alone enforces RLS
• Confusing data source credentials with RLS setup

3. Given a role defined with filter [Region] = "West", what data will a user assigned to this role see in the report?

medium

A. Data from all regions without filtering

B. All data except Region West

C. Only data where Region is West

D. No data will be visible

Solution

1. Step 1: Understand role filter meaning

   The filter [Region] = "West" limits data to rows where Region equals West.

2. Step 2: Determine visible data for user

   User assigned to this role sees only data matching the filter, i.e., Region = West.

3. Final Answer:

   Only data where Region is West -> Option C

4. Quick Check:

   Role filter = visible data = C [OK]

Hint: Role filters show only matching data rows [OK]

Common Mistakes:

• Assuming filter excludes matching data
• Thinking user sees all data regardless of filter
• Believing filter hides all data

4. You assigned users to roles in Power BI Service but they still see all data. What is the most likely issue?

medium

A. Users were assigned to roles correctly

B. Roles were not published from Power BI Desktop

C. Data source credentials are invalid

D. Report visuals are not refreshed

Solution

1. Step 1: Check role publishing status

   Roles must be defined and published from Desktop to Service for RLS to work.

2. Step 2: Identify why users see all data

   If roles are not published, assignments in Service have no effect, so users see all data.

3. Final Answer:

   Roles were not published from Power BI Desktop -> Option B

4. Quick Check:

   Roles must be published for RLS to apply = A [OK]

Hint: Publish roles from Desktop before assigning users [OK]

Common Mistakes:

• Assuming assigning users alone activates RLS
• Blaming data source credentials for RLS issues
• Forgetting to refresh report visuals

5. You have two roles: SalesWest with filter [Region] = "West" and SalesEast with filter [Region] = "East". A user belongs to both roles. What data will they see in the report?

hard

A. Data where Region is West or East

B. Data where Region is both West and East simultaneously

C. Only data from the first assigned role

D. No data because roles conflict

Solution

1. Step 1: Understand multiple role behavior

   When a user has multiple roles, Power BI combines filters with OR logic.

2. Step 2: Apply OR logic to role filters

   User sees data where Region = West OR Region = East, so both regions' data are visible.

3. Final Answer:

   Data where Region is West or East -> Option A

4. Quick Check:

   Multiple roles combine filters with OR = B [OK]

Hint: Multiple roles combine filters with OR logic [OK]

Common Mistakes:

• Thinking filters combine with AND logic
• Assuming only one role applies
• Believing conflicting roles block all data