Troubleshooting Row-Level Security Bypassed by Workspace Roles
Your organization uses Power BI Premium and wants to enforce that users can only see data relevant to their department (Sales, Marketing, Finance) using row-level security (RLS). The dataset contains a 'Department' column. You have created three RLS roles, each with a filter like [Department] = "Sales". You publish the dataset and add users to the roles. However, users in the Sales role can see all data. What is the most likely cause?
Quick Answer
The answer is that users assigned to workspace roles like Member, Contributor, or Admin bypass row-level security restrictions. This occurs because workspace-level permissions grant direct access to the dataset’s underlying data, overriding any RLS filters applied at the role level. In Power BI, RLS only restricts data for users who access reports through the app or shared dashboards without explicit dataset permissions—if a user has a workspace role that allows them to view or edit the dataset, the security filters are ignored entirely. On the PL-300 exam, this scenario tests your understanding of the hierarchy between workspace permissions and RLS, often appearing as a trick where candidates assume the RLS role syntax is faulty. A common trap is forgetting that workspace Members can see all data regardless of RLS. Memory tip: think “Workspace role trumps RLS role”—if they can see the dataset, they see everything.
⚠ Common exam trap
A common trap is assuming that RLS always applies to all users, but workspace-level permissions (Admin, Member, Contributor) supersede RLS. Only users with no workspace role or the 'Viewer' role are subject to RLS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The users are also assigned to workspace roles (e.g., Member) that grant them access to the dataset without RLS restrictions.
In Power BI, users assigned to workspace roles (Admin, Member, Contributor) have dataset-level permissions that bypass Row-Level Security (RLS). Since these users can access the dataset directly, RLS filters are not applied. Option A is incorrect because RLS roles are typically created in Power BI Desktop before publishing. Option B is incorrect; multiple roles combine filters using OR logic, so users in multiple roles see union of all allowed data, not all data. Option C is incorrect because RLS filters are case-insensitive by default. Option D correctly identifies that workspace roles override RLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The RLS roles were created in the Power BI service, not in Power BI Desktop.
Why it's wrong here
RLS roles can be created in Desktop and then applied in the service.
- ✗
The users are members of multiple RLS roles, so they see all data.
Why it's wrong here
Multiple roles combine, but if one role restricts to Sales, they should only see Sales data from that role.
- ✗
The RLS filter uses a string comparison that is case-sensitive and the data contains mixed case.
Why it's wrong here
DAX string comparisons are case-insensitive by default.
- ✓
The users are also assigned to workspace roles (e.g., Member) that grant them access to the dataset without RLS restrictions.
Why this is correct
Users with edit permissions on the dataset bypass RLS.
Go deeper
Related to this question
About these practice questions
This PL-300 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PL-300
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. You are reviewing a DAX expression used in a Power BI measure. You need to ensure that only users in the 'West' region see data for that region. Which approach should you use?
easy- ✓ A.Implement row-level security (RLS) in the dataset with a role filter.
- B.Use the CALCULATE function with a filter on the report page.
- C.Modify the measure to include a conditional statement that checks the user's email.
- D.Create a calculated column with the same logic.
Why A: Row-level security (RLS) in the dataset is the proper method to ensure that users in the 'West' region only see data for that region. RLS uses role filters to restrict data at the row level based on the user's identity. Option B is incorrect because the CALCULATE function with a filter on a report page only affects the measure calculation within that report, not the underlying data security for all reports. Option C is incorrect because modifying a measure to check a user's email is not a supported or secure approach for data restriction in Power BI; RLS should be used instead. Option D is incorrect because a calculated column does not restrict data visibility; it only adds a computed field to the table.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-300 exam.