PL-300 Manage and secure Power BI Practice Question
Your organization uses Power BI and has implemented Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security). A user reports that they are unable to export data from a Power BI report. The Power BI tenant settings allow export. What could be the cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Microsoft Defender for Cloud Apps session policy is blocking the export based on the user's risk level or the report's sensitivity.
The correct answer is D: a Microsoft Defender for Cloud Apps session policy is blocking the export based on the user's risk level or the report's sensitivity. Because Defender for Cloud Apps can proxy Power BI sessions via Conditional Access App Control, its session policies can inspect and block actions like export even when the Power BI tenant setting allows export. Option A is wrong because the scenario states the tenant settings already allow export. Option B is wrong because sensitivity labels alone do not automatically block export; protection is enforced through encryption/permissions, not a blanket export block. Option C is wrong because being an external guest user does not by itself prevent exporting data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'Export to Excel' setting is disabled in the Power BI admin portal.
Why it's wrong here
The 'Export to Excel' setting in the Power BI admin portal is a tenant-wide toggle under Tenant settings. If disabled, the export icon would be unavailable for every user and every report, but the scenario describes a selective block tied to the user or file, indicating the tenant setting is still enabled and points instead to a session policy.
- ✗
A sensitivity label with high classification is applied to the report, automatically blocking export.
Why it's wrong here
Sensitivity labels classify data and can apply encryption, but a label alone—even one marked 'Highly Confidential'—does not automatically remove the Export permission in Power BI. For a label to block export, it must be accompanied by an encryption template that excludes the user's access rights or by a Defender for Cloud Apps/DLP policy that acts on that label. Therefore, the label is not the direct cause.
- ✗
The user is an external guest user.
Why it's wrong here
External guest users can legitimately open and export Power BI reports if they have Viewer or higher permissions on the workspace, because Power BI applies the same export controls to guests as it does to internal users by default. Unless a Conditional Access policy or the external sharing settings are explicitly configured to block guest downloads, guest status alone does not trigger export failure. A Defender session policy, not the guest account type, is what enforces the block.
- ✓
A Microsoft Defender for Cloud Apps session policy is blocking the export based on the user's risk level or the report's sensitivity.
Why this is correct
Microsoft Defender for Cloud Apps session policies use Conditional Access App Control to intercept Power BI sessions in real time. An admin can create a policy that triggers the 'block download' action when a session meets conditions such as a high-risk sign-in or a report containing a specified sensitivity label. This occurs at the proxy layer, so it neither disables the Export button in the UI nor depends on the user being a guest—explaining why the export is blocked for this specific scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PL-300 question from scratch — 524 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-300 exam.