Configure Row-Level Security Sequence PL-300
Short answer
1. From Microsoft Power BI Desktop, create a new RLS role by using a DAX filter. 2. Publish the semantic model. 3. From the Power BI service, assign the new RLS role to the users.
Question
You have a Power BI semantic model.
You need to configure row-level security (RLS) to restrict data access for users that have the Viewer permissions.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Key Takeaways
The common trap is attempting to assign RLS roles in the Power BI Service before publishing the semantic model, which is technically impossible as the role definitions must exist in the published artifact first.
This question tests the correct sequence for implementing Row-Level Security (RLS) in Power BI. The process requires defining roles in Desktop, publishing the model, and then assigning roles in the Service.
Common mistake: Learners often try to assign roles in the Service immediately after creating them in Desktop, forgetting that the 'Publish' action is the mandatory bridge that transfers the security schema to the cloud workspace.
Expert Analysis
Why the Answer Is Correct
To configure Row-Level Security (RLS) effectively, you must follow a strict three-step lifecycle. First, you define the security logic by creating RLS roles and DAX filters within Power BI Desktop using the Modeling tab. Second, you publish this updated semantic model to the Power BI Service; this step is critical because it uploads the role definitions to the cloud environment where user assignments occur. Third, you navigate to the workspace settings in the Power BI Service to assign specific users or groups to the newly created roles. This sequence ensures that the security rules are present in the service before any users are mapped to them.
Why Other Candidate Answers Are Wrong
Any sequence that places 'Assign role' before 'Publish' is invalid because the Power BI Service cannot manage roles that have not yet been deployed from Desktop. Conversely, placing 'Publish' before 'Create role' defeats the purpose, as you would be publishing a model without the intended security constraints. Attempts to mix these steps ignore the dependency of the Service's assignment interface on the pre-existing role definitions in the Desktop file.
Community Comment Notes
Community consensus strongly supports the 'Create -> Publish -> Assign' sequence. Multiple users noted that the provided answer was initially confusing but confirmed that logical deployment requires publishing before assignment. As one user stated, "Without publishing you can't assign roles in PBI Service." Another commenter emphasized, "Correct sequence: Define roles... Publish... Assign," highlighting the technical necessity of the upload step.
Exam Strategy
When dealing with Power BI deployment questions, always remember that Power BI Desktop is for authoring and Power BI Service is for governance. You cannot govern (assign roles) what hasn't been deployed (published).
Frequently Asked Questions
Can I assign RLS roles in Power BI Desktop?
Why must I publish before assigning roles?
Discussion 11 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 11
-
b2775a4 👍 29Correct Sequence: 1. From Microsoft Power BI Desktop, create a new RLS role by using a DAX filter. • You must first define the RLS roles and the corresponding DAX filters in Power BI Desktop to determine how data is restricted for different users. 2. Publish the semantic model. • After creating the RLS roles, you need to publish the semantic model to the Power BI Service to apply these roles in the cloud environment. 3. From the Power BI service, assign the new RLS role to the users. • Once the model is published, you assign the roles to specific users or groups in the Power BI Service to enforce RLS.
-
MANANDAVEY 👍 11Given answer is wrong. 1. From Microsoft Power BI Desktop, create a new RLS role by using a DAX filter. 2. Publish the semantic model. 3. From the Power BI service, assign the new RLS role to the users. Correct sequence.
-
Jasmine121 👍 3The given answer is wrong. You have to first publish your semantic model to the power bi service and next you can do RLS setting on your report. I go for (1) From Desktop.... (2) Publish the senmatic model (3) From the Power BI service...
-
Lulu_2022 👍 2the answer is wrong Correct sequence: - Define roles and rules in Power BI Desktop - Go to the Modeling tab → Manage Roles - Create roles and apply DAX filters to restrict data (e.g., [Region] = "West" or dynamic filters using USERPRINCIPALNAME()) - Publish the semantic model to the Power BI Service - This uploads the model along with the defined RLS roles to your workspace. - Assign users or groups to the roles in the Power BI Service - In the workspace, go to the dataset → click More options (⋯) → Security - Add users or security groups to the appropriate RLS roles.
-
Sana92 👍 2wrong sequence 1,3,2 create role publish report assign role
Show 6 more comments
-
Dusica 👍 2Create > Publish > Assign
-
e68b25f 👍 1From Power BI Desktop, create a new RLS role by using a DAX filter. Publish the semantic model. From the Power BI service, assign the new RLS role to the users. Without publishing you can't assign roles in PBI Service.
-
SylUK 👍 1I am ok with the answer's order 1. From Microsoft Power BI Desktop, create a new RLS role by using a DAX filter 2. From the Power BI service, assign the new RLS role to the users. 3. Publish the semantic model.
-
be79ac3 👍 11.2.3 Makes more sense you have updated the version in the desktop, then published, then headed to the service.
-
0002110 👍 1Yes this is the correct sequence
-
0002110 👍 1wrong sequence
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All PL-300 Questions
Access 116 questions with complete answers and detailed explanations.
View Full PL-300 Practice Test →