Configure Row-Level Security Sequence PL-300
DRAG DROP
You have a Power BI semantic model.
You need to configure row-level security (RLS) to restrict data access for users that have the Viewer permissions.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Community Insight
The common trap is attempting to assign RLS roles in the Power BI Service before publishing the semantic model, which is technically impossible as the role definitions must exist in the published artifact first.
This question tests the correct sequence for implementing Row-Level Security (RLS) in Power BI. The process requires defining roles in Desktop, publishing the model, and then assigning roles in the Service.
Learners often try to assign roles in the Service immediately after creating them in Desktop, forgetting that the 'Publish' action is the mandatory bridge that transfers the security schema to the cloud workspace.
Community Discussion (11 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To configure Row-Level Security (RLS) effectively, you must follow a strict three-step lifecycle. First, you define the security logic by creating RLS roles and DAX filters within Power BI Desktop using the Modeling tab. Second, you publish this updated semantic model to the Power BI Service; this step is critical because it uploads the role definitions to the cloud environment where user assignments occur. Third, you navigate to the workspace settings in the Power BI Service to assign specific users or groups to the newly created roles. This sequence ensures that the security rules are present in the service before any users are mapped to them.Why Other Candidate Answers Are Wrong
Any sequence that places 'Assign role' before 'Publish' is invalid because the Power BI Service cannot manage roles that have not yet been deployed from Desktop. Conversely, placing 'Publish' before 'Create role' defeats the purpose, as you would be publishing a model without the intended security constraints. Attempts to mix these steps ignore the dependency of the Service's assignment interface on the pre-existing role definitions in the Desktop file.Community Comment Notes
Community consensus strongly supports the 'Create -> Publish -> Assign' sequence. Multiple users noted that the provided answer was initially confusing but confirmed that logical deployment requires publishing before assignment. As one user stated, "Without publishing you can't assign roles in PBI Service." Another commenter emphasized, "Correct sequence: Define roles... Publish... Assign," highlighting the technical necessity of the upload step.Exam Strategy
When dealing with Power BI deployment questions, always remember that Power BI Desktop is for authoring and Power BI Service is for governance. You cannot govern (assign roles) what hasn't been deployed (published).
Frequently Asked Questions
Can I assign RLS roles in Power BI Desktop?
No. You only define the roles and filters in Desktop. Assignment of users to those roles happens exclusively in the Power BI Service.
Why must I publish before assigning roles?
Publishing uploads the semantic model, including the RLS role definitions, to the Power BI Service. You cannot assign users to roles that do not exist in the cloud workspace.
Related Analysis
Practice All PL-300 Questions
Access 116 questions with complete answers and detailed explanations.
View Full PL-300 Practice Test →