Validating Dynamic RLS in Power BI

DP-600 By islever Editorial Last updated

Short answer

C Select Test as role to view the report as the HR manager.

Question

You have a semantic model named Model1. Model1 contains five tables that all use Import mode. Model1 contains a dynamic row-level security (RLS) role named HR. The HR role filters employee data so that HR managers only see the data of the department to which they are assigned. You publish Model1 to a Fabric tenant and configure RLS role membership. You share the model and related reports to users. An HR manager reports that the data they see in a report is incomplete. What should you do to validate the data seen by the HR Manager?
  1. Select Test as role to view the data as the HR role.
  2. Filter the data in the report to match the intended logic of the filter for the HR department.
  3. Select Test as role to view the report as the HR manager. Correct Answer
  4. Ask the HR manager to open the report in Microsoft Power BI Desktop.

Key Takeaways

The question tests the distinction between static and dynamic RLS, where selecting a generic role fails to validate user-specific data access without specifying the user identity.

This question addresses how to troubleshoot incomplete data visibility for users with dynamic row-level security (RLS) roles. The correct approach involves testing the role as a specific user to account for individual filtering logic.

Common mistake: Many learners choose Option A because it references the role name 'HR' directly, missing that dynamic RLS requires impersonating a specific person to see their filtered view.

Expert Analysis

Why the Answer Is Correct

Option C is correct because dynamic Row-Level Security (RLS) relies on user attributes (like email or department) to filter data at runtime. To validate what an HR manager sees, you must use the 'Test as role' feature but specify the actual user (the HR manager). This allows you to see exactly which rows are visible to that specific individual based on the dynamic rules applied to their identity.

Why the Other Options Are Wrong

Option A selects only the role ('HR') without a user context; while valid for static roles, it does not fully simulate the experience of a specific user in a dynamic setup. Option B suggests manually filtering in the report, which is a workaround rather than a validation of the security configuration. Option D is incorrect because opening Power BI Desktop locally does not reflect the published service behavior or RLS membership configured in the tenant.

Community Comment Notes

Community consensus strongly favors C, noting that 'dynamic' implies per-user logic. As one commenter noted, 'Selecting A... would work for a static rule... but as it is dynamic you will need to input as well the HR manager email.' Another user clarified that 'There's no role called HR MANAGER,' emphasizing the need to test as the person, not just the role definition.

Official Reference

https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls

This link opens the official vendor documentation in a new tab.

Exam Strategy

When troubleshooting RLS issues involving 'dynamic' roles, always look for options that involve testing as a specific user rather than just the role itself. This ensures you are validating the intersection of the role definition and the user's specific attributes.

Frequently Asked Questions

Why can't I just test as the 'HR' role?

Static roles show all data allowed by the role. Dynamic roles require a specific user identity to apply filters correctly, so testing as a user is necessary.

Does 'Test as role' work in Power BI Service?

Yes, administrators can use 'Test as role' in the Power BI Service portal to simulate access for specific users assigned to roles.

More DP-600 FAQ →

Community Votes

C
79%
A
21%

79% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 22 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 22

  1. [Removed] 👍 16 Answered C
    Although A basically is true as well, C would be "the most" correct. For instance, if the HR manager is not part of the HR role, doing as described in A would not help you troubleshoot the issue. Also, if the RLS is set up such that different HR managers have different rows visible, you have to select the person. Thus, C is more correct than A.
  2. hmntkmr 👍 7
    Role name is HR not HR manager so the answer is A.
  3. ab695 👍 5
    Correct answer is C., 100%. The key is in the "dynamic" row-level security. Selecting A. (HR Role only) would work for a static rule for RLS, but as it is dynamic you will need to input as well the HR manager email and make sure the rule is applied correctly.
  4. belha 👍 4 Answered C
    you can test roles on report view , so you can see the report as " " answer is C
  5. thisiston 👍 3 Answered A
    A. Select Test as role to view the data as the HR role. This option allows you to impersonate the HR role directly within the environment where the data is published, such as Microsoft Power BI Service. By using the "Test as role" feature, you can see exactly what data the HR role (and thus the HR managers) can access according to the dynamic row-level security settings. This method provides a straightforward way to validate the RLS implementation and ensure it is working as intended.
Show 17 more comments
  1. trietnv 👍 2
    A. the question is about how to validate role of a user. https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls#validate-the-roles-within-power-bi-desktop
  2. a998450 👍 2
    first of all he is able to see data but it is incomplete test as hr role will not help to find issue. when he test role as manager then only he will understand the issue
  3. 554b579 👍 2
    https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls You can test a role or a person ... in this case I would test as the HR Manager
  4. stilferx 👍 2 Answered C
    IMHO, C) HR Manager is the winner. No HR role, because each HR assigned to the own department.
  5. c2834e0 👍 2
    Theres no role called HR MANAGER !!! Answer is A
  6. AbhiShar 👍 1
    Answer is A A. Select Test as role to view the data as the HR role: This option allows you to simulate the RLS settings directly. By testing the role, you can see exactly what data is being presented to users assigned to the HR role, which helps you identify if the filtering logic is correctly implemented and if there are any issues with data visibility. B. Filter the data in the report to match the intended logic of the filter for the HR department: While this might help in analyzing the report data, it does not address whether the RLS is functioning as intended. The filtering in the report might not accurately represent the RLS logic. C. Select Test as role to view the report as the HR manager: This option would allow you to see the report from the perspective of the HR manager, but it may not provide clarity on how the RLS is filtering data specifically. D. Ask the HR manager to open the report in Microsoft Power BI Desktop: This option does not directly help you validate the data as it would not give you insight into the RLS logic being applied.
  7. 282b85d 👍 1 Answered C
    Option C (Select "Test as role" to view the report as the HR manager) is the best approach as it directly validates what the specific HR manager sees under the dynamic RLS conditions, ensuring the completeness and accuracy of the data. A. Select "Test as role" to view the data as the HR role: This option is useful, but it doesn't specify viewing the report as the specific HR manager, which is crucial to identify user-specific issues.
  8. Pegooli 👍 1 Answered A
    The "Test as role" feature in Power BI allows you to impersonate a role to see the data as a user assigned to that role would see it. This helps in validating the RLS settings and ensuring that the data is being filtered correctly according to the RLS rules.
  9. e0f0ce6 👍 1
    You have to check the problem of a particular user. So we should select "C". Maybe the user isn't part of the role. So "A" would achieve nothing.
  10. Unbounded 👍 1 Answered B
    A & C: says "Test" as role. We do not know what conditions we have in Test. To test these conditions we should select B
  11. b6daab0 👍 1
    I chose A because only role and not a specific user can be tested using "Test as role".
  12. 2dc6125 👍 1
    what is the difference btw see data (A) or see report (C)?
  13. pk07 👍 1 Answered A
    A. Select Test as role to view the data as the HR role.
  14. clux 👍 3 Answered C
    A or C, they are very similar
  15. 6d1de25 👍 1 Answered C
    C View as report is correct
  16. 6d1de25 👍 1 Answered A
    A is the correct answer
  17. tawfik21A 👍 1 Answered A
    role name is HR

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Fabric Deployment Pipeline Folder Structure Behavior

S-grade

Accessing OneLake Shortcuts in Fabric Notebooks

S-grade

Direct Lake Fallback to DirectQuery with Row-Level Security

S-grade

Displaying All Rows in Power BI Python Visuals

S-grade

Practice All DP-600 Questions

Access 115 questions with complete answers and detailed explanations.

View Full DP-600 Practice Test →

← Back to DP-600 Study Guide