Manage and secure Power BI

A Power BI administrator needs to enforce that all datasets published to the service use certified data sources only. Which two settings should be configured? (Choose two.)

You are a Power BI administrator. A user reports that their scheduled data refresh fails with error 'The data source credentials are no longer valid.' The dataset uses a SQL Server database with Windows authentication. What should you do first to resolve the issue?

You are a Power BI administrator. Your organization uses Microsoft Purview to manage sensitivity labels. You need to ensure that when a report is exported to PDF, the sensitivity label is automatically applied to the PDF file. What should you configure?

A Power BI administrator wants to allow users to create dashboards and reports, but prevent them from sharing content outside the organization. Which two settings should be configured in the Power BI admin portal? (Choose two.)

You are a Power BI administrator. A Power BI dataset owner reports that the dataset is not refreshing automatically, but manual refreshes work fine. The dataset uses a cloud data source (Azure SQL Database) with OAuth2 credentials. What is the most likely cause?

You are a Power BI administrator. A user in the Sales department needs to create reports using a shared dataset, but should not be able to modify the dataset or share it with others. What is the minimum permission level you should assign to the user on the dataset?

A Power BI administrator needs to audit which users have exported data from a specific report in the last 30 days. What is the most efficient way to retrieve this information?

Refer to the exhibit. You are reviewing a Power BI activity log entry. What action should you take to ensure compliance if the user who created the report should not have access to 'Confidential' data?

You are a Power BI administrator. Your organization uses Microsoft Entra ID for identity management. You need to ensure that only users from specific security groups can access the Power BI service. What should you configure?

A Power BI administrator needs to ensure that all reports in a workspace are labeled with a sensitivity label automatically when created. The workspace is used by multiple departments. What should the administrator configure?

A Power BI administrator needs to ensure that reports containing sensitive financial data are only accessible to users who have completed mandatory training and are using compliant devices. The organization uses Microsoft Entra ID and Microsoft Intune. Which feature should the administrator configure?

A user reports that they cannot publish a Power BI Desktop file to the Power BI service. The error message indicates insufficient permissions. The user is a member of a workspace and has the Viewer role. What is the most likely cause?

Which TWO actions are required to enable Bring Your Own Key (BYOK) encryption for Power BI datasets? (Select exactly two.)

A Power BI administrator needs to allow an external partner organization to access a specific report without requiring them to have Power BI Pro licenses. The report is stored in a workspace assigned to a Premium capacity. What is the correct configuration?

You have a Power BI capacity that is frequently hitting its memory limits, causing refreshes to fail. You need to reduce memory usage without increasing capacity size. What should you do?

You need to grant a user the ability to manage permissions on a Power BI workspace but not to view or edit the content. What minimum role should you assign?

Which TWO methods can you use to share a Power BI report with external users who do not have a Power BI Pro license? (Choose two.)

Your organization uses Microsoft Defender for Cloud Apps to monitor Power BI activity. You need to receive an alert when a user exports a report with a sensitivity label of 'Highly Confidential' from Power BI service. What should you configure?

Your organization uses Power BI Premium capacity. You notice that reports are slow during peak hours. You need to identify which workspaces are consuming the most CPU resources on the capacity. What should you use?

You have a Power BI dataset that uses DirectQuery to a SQL Server data warehouse. You need to ensure that when users view reports, they see only data relevant to their department. The data warehouse contains a 'Department' column. What should you implement?

You need to audit Power BI activities such as viewing reports, sharing dashboards, and exporting data. Which TWO actions should you take to enable and access audit logs? (Choose two.)

Refer to the exhibit. The Power BI admin settings are shown. A user reports that they cannot share a dashboard with an external partner. What is the most likely reason?

Your organization uses Power BI in a shared capacity model. A report developer complains that a new report published to a workspace does not appear in the 'My workspace' area. They have the Contributor role on the workspace. What is the most likely cause?

You need to grant a user the ability to manage permissions, add members, and edit content in a Power BI workspace, but not delete the workspace. Which role should you assign?

Your organization is implementing a data sensitivity labeling strategy for Power BI. You have created labels in Microsoft Purview Compliance Portal. After publishing a report, you notice that some labels are not available for selection in Power BI. What is the most likely cause?

You need to share a Power BI dashboard with a large group of users in your organization. The users should not be able to edit the dashboard or share it with others. What is the most efficient method?

Which TWO are valid Power BI workspace roles?

Refer to the exhibit. You are reviewing a DAX expression used in a Power BI measure. You need to ensure that only users in the 'West' region see data for that region. Which approach should you use?

A Power BI admin receives a support ticket that a user cannot see any data in a report that uses row-level security (RLS). The report is based on a dataset with a single table 'Sales' and RLS roles defined. The user is assigned to the role 'SalesManager' which filters Sales[Region] = 'West'. The dataset uses Import mode. The user can see the report but all visuals show blank. What is the most likely cause?

A Power BI report uses a composite model combining Import and DirectQuery sources. When a user filters a visual, the report takes a long time to update. The admin wants to diagnose performance issues. Which tool should the admin use?

A data analyst creates a Power BI report using a dataset that contains sensitive salary information. The analyst needs to ensure that only HR managers can see salary columns. What should the analyst use?

Which TWO methods can a Power BI admin use to enforce the use of sensitivity labels on reports? (Choose two.)

Refer to the exhibit. A user is a member of both 'HRManager' and 'Executive' RLS roles. The dataset uses DirectQuery. When the user views a report showing all employees, what data will they see?

Refer to the exhibit. User2 wants to add a new user to the Finance workspace. Can User2 perform this action, and why?

You are a Power BI administrator. You need to prevent users from exporting underlying data from reports. Which tenant setting should you disable?

You have a Power BI report that uses a DirectQuery dataset. You need to ensure that users see only the data relevant to their department. What should you implement?

Your organization is deploying Power BI content to multiple stages (dev, test, prod) using deployment pipelines. You need to ensure that test data is not visible to production users. What is the best approach?

You need to audit Power BI activity for compliance. Which tool should you use to access detailed logs of user actions?

You have a Power BI dataset that connects to an Azure SQL Database. You need to use single sign-on (SSO) so that users' identities are passed to the database. What authentication method should you configure?

Your organization uses Microsoft Intune to manage devices. You need to ensure that Power BI reports can only be viewed on managed devices that are compliant with company policies. What should you configure?

Your organization uses row-level security (RLS) in Power BI. You have a table 'Sales' with a column 'Region'. You define a role 'RegionManagers' with the filter: [Region] = "North". A user named Alice is a member of this role. However, when Alice views a report that uses this dataset, she sees all regions. What is the most likely reason?

You are a Power BI administrator. A user reports that they are unable to share a dashboard with an external user from a partner organization. The external user has a Microsoft Entra ID account in their own tenant. What is the most likely reason?

Your organization uses Power BI with Premium capacity. You need to configure a scheduled refresh for a dataset that connects to an Azure SQL Database. The refresh must complete before 6:00 AM every day. The dataset currently takes 45 minutes to refresh. What is the most important consideration?

You are a Power BI administrator. You need to audit all activities related to sharing reports and dashboards in the Power BI service. Which tool should you use?

You create a Power BI report that uses a live connection to an Azure Analysis Services (AAS) model. You want to enforce row-level security defined in the AAS model. What should you do?

Which TWO are valid methods to secure access to a Power BI dataset? (Select exactly two.)

You are a Power BI administrator. A user reports they cannot publish a report to a shared workspace because they receive an error 'You need at least a Contributor role to publish to this workspace.' The user is a member of a security group that has been assigned the Viewer role on the workspace. What should you do to allow the user to publish?

Your organization uses Power BI with a shared capacity (no Premium capacity). You need to implement row-level security (RLS) on a dataset that is used by multiple reports. Which of the following is a limitation you must consider?

Which TWO of the following are valid methods to share a Power BI report with external users (outside your organization)? (Choose two.)

Which THREE of the following are required to configure Microsoft Purview Information Protection sensitivity labels for Power BI? (Choose three.)

Your organization uses Power BI and has deployed Microsoft Purview Data Loss Prevention (DLP) policies. You want to prevent users from exporting data from Power BI reports that contain credit card numbers. What should you configure?

Your organization uses Power BI and has implemented Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security). A user reports that they are unable to export data from a Power BI report. The Power BI tenant settings allow export. What could be the cause?

You are a Power BI administrator. A user in your organization wants to share a report with an external user who does not have a Power BI license. You want to allow the external user to view the report without requiring them to sign in. What should you do?

Your organization uses Microsoft Purview to catalog Power BI assets. You need to ensure that all published reports and dashboards are automatically scanned and added to the catalog. What should you do?

You need to audit which users have accessed a specific Power BI dashboard in the last 30 days. What should you use?

Refer to the exhibit. A Power BI dataset has the scheduled refresh configuration shown in the JSON. The refresh fails on Monday, March 2, 2026. Who will be notified?

You have a Power BI workspace named Sales. You need to ensure that only users in the Finance security group can view reports in this workspace, while members of the Sales team can edit and share content. What should you do?

Refer to the exhibit. You have a Power BI dataset with the JSON policy shown. You add a user to the USOnly role. What happens when that user views a report based on this dataset?

You have a Power BI dataset that uses a live connection to an Azure Analysis Services (AAS) model. The AAS model has object-level security (OLS) that hides certain measures. Your Power BI report users need to see those measures. What should you do?

Your organization uses Microsoft Power BI with Microsoft Purview for data governance. You have a dataset that contains customer data classified as 'Highly Confidential' under a sensitivity label. The compliance team requires that when this dataset is shared with external users, a Microsoft Purview data loss prevention (DLP) policy must block the sharing and notify the compliance team. You need to configure this. What should you do?

You are a Power BI administrator. The company has a premium capacity that many users publish reports to. Recently, users have reported that some reports are slow to load. You suspect that the capacity is being overused by certain large datasets. You need to identify which workspaces and datasets are consuming the most memory and CPU resources on the capacity. You want to use a tool that provides historical metrics and can be queried. What should you do?

Your organization uses Power BI with a shared capacity. You have a dataset that is refreshed daily from an on-premises SQL Server database using an on-premises data gateway. The dataset contains sensitive financial data. The security team requires that all access to the dataset be logged and that any access from outside the corporate network be flagged. You need to implement a monitoring solution. What should you do?

You are the Power BI administrator for a company that uses Microsoft 365. The security team requires that when a user opens a Power BI report on a personal device, the user must authenticate with Microsoft Entra ID and satisfy a conditional access policy that demands multifactor authentication. The report is in a workspace that is not backed by Fabric capacity. Which feature should you enable to meet this requirement?

You manage a Power BI tenant. A workspace named 'Finance' contains a dataset that uses an on-premises SQL Server data source via an on-premises data gateway. The gateway is configured with a single data source that uses a SQL Server account for authentication. You need to ensure that when users view reports based on this dataset, they see only data for their own department, and the filtering must be enforced at query time without modifying the dataset. What should you do?

You are a Power BI administrator. The compliance team requires that all Power BI datasets and reports must be retained for seven years, even if users delete them. You need to configure the tenant to meet this requirement with minimal administrative effort. What should you do?

You are a Power BI administrator. A new analyst joins the team and needs to publish reports to an existing workspace named Sales Analytics. The analyst must be able to create and edit content in the workspace but must not be allowed to add or remove other members or change workspace settings. Which workspace role should you assign to the analyst?

You are a Power BI administrator. You need to ensure that users in your organization can only access Power BI through the web browser and cannot use the Power BI Desktop application to connect to the Power BI service. Which tenant setting should you configure?

You are a Power BI administrator. You need to configure a data loss prevention (DLP) policy in Microsoft Purview to protect sensitive information in Power BI. The policy must detect and restrict sharing of reports that contain credit card numbers. Which two actions should you perform? (Choose two.)

You are a Power BI administrator. Your organization uses Microsoft Purview sensitivity labels integrated with Power BI. A report author applies a sensitivity label named 'Confidential' to a Power BI dataset. Later, the author exports a Power BI report that uses this dataset to a PDF file. You need to ensure that the exported PDF file retains the same sensitivity label and protection settings as the dataset. What should you do?

You are a Power BI administrator. Your organization has a Power BI Premium capacity. You need to configure a new workspace to use a specific capacity and ensure that only users with the 'Contributor' role can publish content to the workspace, while users with the 'Viewer' role can only view reports. Which two actions should you perform? (Choose two.)

You are a Power BI administrator. A user reports that they cannot refresh a dataset that connects to an on-premises SQL Server using a gateway. The dataset was previously refreshing successfully. You need to ensure that the dataset can refresh again. What should you do first?