Assigning Workspace Roles to Security Groups
You have a Power BI workspace named Sales. You need to ensure that only users in the Finance security group can view reports in this workspace, while members of the Sales team can edit and share content. What should you do?
Quick Answer
Assigning Finance as Viewer and Sales as Member is the answer because Power BI workspace roles are built as a ladder of increasing permission, and this scenario asks for two very different points on that ladder for two different groups. Viewer sits at the bottom and grants read-only access, which is exactly what Finance needs since they should only view reports, not change anything. Member sits higher up and grants both editing and sharing rights, matching the Sales team's need to build out and distribute content. The distractor roles fail for specific, testable reasons rather than vague overreach: Contributor allows editing but cannot share content, so it would leave Sales unable to do part of what the scenario requires; Admin grants full control including managing workspace permissions and membership, which goes well beyond what either group needs and introduces unnecessary risk; and row-level security operates inside a report to filter which data rows a user sees, which is a completely different mechanism from workspace roles that control what a user can do with the workspace itself. When you see a scenario describing different groups needing different levels of access to the same workspace, map each group's required actions -- view only, or view plus edit plus share -- directly onto the specific role that grants exactly that and nothing more.
⚠ Common exam trap
A common trap is confusing Contributor with Member. Contributor can edit but not share, while Member can both edit and share. Also, a candidate might think Viewer is insufficient for Finance, but it correctly restricts access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add Finance as Viewer, Sales as Member.
Workspace roles in Power BI are designed to grant specific permissions: Viewer allows read-only access, ideal for Finance who only need to view reports; Member allows editing and sharing, which matches the Sales team's requirements. Option B is wrong because Contributor role cannot share content, which Sales needs. Option C is wrong because Admin grants full control, including managing permissions, which is unnecessary and excessive. Option D is wrong because row-level security (RLS) controls data access within reports, not workspace-level permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add Finance as Viewer, Sales as Member.
Why this is correct
Correct. Viewer provides read-only access for Finance, Member allows Sales to edit and share.
- ✗
Add Finance as Contributor, Sales as Member.
Why it's wrong here
Incorrect. Contributor can edit but cannot share content; Sales needs to share, so Member is required.
- ✗
Add Finance as Viewer, Sales as Admin.
Why it's wrong here
Incorrect. Admin grants full control including managing permissions, which is excessive for Sales.
- ✗
Use row-level security to restrict Finance data, add both as Member.
Why it's wrong here
Incorrect. RLS restricts data access, not workspace-level access; it does not fulfill the sharing requirement.
Go deeper
Related to this question
About these practice questions
This PL-300 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PL-300
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that only members of the 'Sales' security group can edit reports in the 'Sales Reports' workspace. The workspace currently has four members: three from Sales and one from Marketing. What should you do?
easy- ✓ A.Add the Sales security group as a workspace Admin and remove the Marketing user.
- B.Configure the workspace to allow only specific users to edit by using the 'Restrict editing' option.
- C.Publish the reports to a Power BI app and grant the Sales group 'Build' permissions.
- D.Assign the Sales security group the 'Contributor' role and keep the Marketing user as 'Member'.
Why A: Adding the Sales security group as a workspace Admin grants full editing capabilities to all members of that group. Removing the Marketing user from the workspace ensures that only Sales members have edit access. Workspace roles like Admin allow editing of reports and other content. Option B is incorrect because Power BI does not have a 'Restrict editing' option at the workspace level; access is controlled through roles. Option C is incorrect because publishing reports as a Power BI app with 'Build' permissions does not control editing within the workspace; it controls how consumers interact with the app content. Option D is incorrect because keeping the Marketing user as a 'Member' still allows them to edit content in the workspace, which contradicts the requirement that only Sales members can edit.
Variation 2. Refer to the exhibit. You run a PowerShell script to list workspaces and their users. You need to ensure that only members of the sales security group can access the Sales workspace. What should you do?
medium- A.Restore the Marketing workspace and move the reports there.
- B.Add the sales security group as a Contributor to the Sales workspace.
- C.Change the sales security group's role to Viewer.
- ✓ D.Remove the individual users (user1 and user2) from the Sales workspace.
Why D: The exhibit shows that the sales security group is already an Admin of the Sales workspace. However, there are individual users (user1 and user2) with Member and Contributor roles. To ensure only members of the sales security group can access the workspace, these individual users must be removed. Option A is incorrect because restoring the Marketing workspace does not affect access to the Sales workspace. Option B is incorrect because the sales security group already has Admin role, which includes Contributor permissions and more. Option C is incorrect because changing the security group's role to Viewer would reduce its permissions, but the main issue is the presence of individual users, not the security group's role.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-300 exam.