Question 737 of 976

Describe the business value of Microsoft Power Platform →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is that the Employee security role has 'Read' permission set to 'Organization' scope instead of 'User'. This is because Dataverse security roles control record visibility through permission scopes: 'Organization' grants access to all records in a table, while 'User' restricts visibility to only records the user owns or is assigned to. In this scenario, the employee sees all assets because the role's Read scope is too broad, a classic misconfiguration when you need to restrict record visibility with Dataverse security roles. On the PL-900 exam, this tests your understanding of role-based security and the hierarchy of scopes—User, Business Unit, Parent Child, and Organization. A common trap is confusing 'User' scope with simply having a user role; remember that scope defines how many records the user can see, not just what they can do. Memory tip: think "User scope = Your own stuff; Organization scope = Everybody's stuff."

PL-900 Practice Question: Describe the business value of Microsoft Power Platform

This PL-900 practice question tests your understanding of describe the business value of microsoft power platform. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Exhibit

{
  "app": {
    "name": "Asset Management",
    "dataSource": "Microsoft Dataverse",
    "tables": [
      {
        "name": "Asset",
        "columns": [
          {"name": "Name", "type": "Text"},
          {"name": "SerialNumber", "type": "Text"},
          {"name": "AssignedTo", "type": "Lookup", "targetTable": "User"},
          {"name": "Status", "type": "Choice", "options": ["Active", "Inactive", "Disposed"]}
        ]
      }
    ],
    "roles": [
      {
        "name": "Asset Manager",
        "permissions": "Create, Read, Write"
      },
      {
        "name": "Employee",
        "permissions": "Read"
      }
    ]
  }
}

Refer to the exhibit. A Power Apps app uses Dataverse with the defined table and roles. An employee reports that they can see all assets in the app, but they should only see assets assigned to them. What is the most likely reason?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1mediummultiple choice

Full question →

Exhibit

{
  "app": {
    "name": "Asset Management",
    "dataSource": "Microsoft Dataverse",
    "tables": [
      {
        "name": "Asset",
        "columns": [
          {"name": "Name", "type": "Text"},
          {"name": "SerialNumber", "type": "Text"},
          {"name": "AssignedTo", "type": "Lookup", "targetTable": "User"},
          {"name": "Status", "type": "Choice", "options": ["Active", "Inactive", "Disposed"]}
        ]
      }
    ],
    "roles": [
      {
        "name": "Asset Manager",
        "permissions": "Create, Read, Write"
      },
      {
        "name": "Employee",
        "permissions": "Read"
      }
    ]
  }
}

A
The Employee security role has 'Read' permission set to 'Organization' scope instead of 'User'
With 'Organization' scope, users see all records; with 'User' scope, they see only records they own or are assigned to.
B
The Asset table does not have a relationship to the User table
Why wrong: The table has an AssignedTo lookup to User, so relationship exists.
C
The employee is not the owner of the asset records
Why wrong: Ownership is not required; the AssignedTo field could be used with 'User' scope if scoped to that field.
D
The app is not configured to filter records based on the current user
Why wrong: Even if the app does not filter, security roles would limit at the data layer if set correctly.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Employee security role has 'Read' permission set to 'Organization' scope instead of 'User'

Option A is correct because the Employee security role's 'Read' permission is set to 'Organization' scope, which allows the employee to see all asset records in the Dataverse table. To restrict visibility to only assets assigned to the employee, the 'Read' permission should be set to 'User' scope, which limits record access to those the user owns or is assigned to. This is a common misconfiguration in Dataverse role-based security that directly causes the reported issue.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The Employee security role has 'Read' permission set to 'Organization' scope instead of 'User'
Why this is correct
With 'Organization' scope, users see all records; with 'User' scope, they see only records they own or are assigned to.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The Asset table does not have a relationship to the User table
Why it's wrong here
The table has an AssignedTo lookup to User, so relationship exists.
✗
The employee is not the owner of the asset records
Why it's wrong here
Ownership is not required; the AssignedTo field could be used with 'User' scope if scoped to that field.
✗
The app is not configured to filter records based on the current user
Why it's wrong here
Even if the app does not filter, security roles would limit at the data layer if set correctly.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often assume the app must explicitly filter records (Option D) or that a table relationship is needed (Option B), when in fact Dataverse's built-in security role scopes handle record-level visibility automatically without custom app logic.

Detailed technical explanation

How to think about this question

In Dataverse, security roles define access levels using a combination of privileges (e.g., Read, Write) and scopes (User, Business Unit, Parent: Child Business Units, Organization). The 'User' scope restricts record access to those owned by the user or assigned to them, while 'Organization' scope grants access to all records in the table. This is enforced at the database query level, meaning even if an app tries to show all records, the platform filters them based on the user's role permissions. A real-world scenario is a field service app where technicians should only see their assigned work orders; misconfiguring the scope to Organization would expose all work orders to every technician.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PL-900 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Identify foundational components of Power Platform practice questions

Practise PL-900 questions linked to Identify foundational components of Power Platform.

Demonstrate capabilities of Power BI practice questions

Practise PL-900 questions linked to Demonstrate capabilities of Power BI.

Describe complementary Microsoft Power Platform solutions practice questions

Practise PL-900 questions linked to Describe complementary Microsoft Power Platform solutions.

Demonstrate the capabilities of Power Automate practice questions

Practise PL-900 questions linked to Demonstrate the capabilities of Power Automate.

Describe the business value of Microsoft Power Platform practice questions

Practise PL-900 questions linked to Describe the business value of Microsoft Power Platform.

Manage the Microsoft Power Platform environment practice questions

Practise PL-900 questions linked to Manage the Microsoft Power Platform environment.

Identify foundational components of Microsoft Power Platform practice questions

Practise PL-900 questions linked to Identify foundational components of Microsoft Power Platform.

Demonstrate the capabilities of Power BI practice questions

Practise PL-900 questions linked to Demonstrate the capabilities of Power BI.

Demonstrate the capabilities of Power Apps practice questions

Practise PL-900 questions linked to Demonstrate the capabilities of Power Apps.

Demonstrate the capabilities of Microsoft Copilot Studio practice questions

Practise PL-900 questions linked to Demonstrate the capabilities of Microsoft Copilot Studio.

Demonstrate the capabilities of Power Pages practice questions

Practise PL-900 questions linked to Demonstrate the capabilities of Power Pages.

PL-900 fundamentals practice questions

Practise PL-900 questions linked to PL-900 fundamentals.

Practice this exam

Start a free PL-900 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PL-900 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PL-900 question test?

Describe the business value of Microsoft Power Platform — This question tests Describe the business value of Microsoft Power Platform — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The Employee security role has 'Read' permission set to 'Organization' scope instead of 'User' — Option A is correct because the Employee security role's 'Read' permission is set to 'Organization' scope, which allows the employee to see all asset records in the Dataverse table. To restrict visibility to only assets assigned to the employee, the 'Read' permission should be set to 'User' scope, which limits record access to those the user owns or is assigned to. This is a common misconfiguration in Dataverse role-based security that directly causes the reported issue.

What should I do if I get this PL-900 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on PL-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A healthcare provider needs to ensure that only authorized users can access patient data in a Power Apps app. The app uses Dataverse. What should the administrator configure?

medium

A.Configure SharePoint permissions for the app
B.Set environment as restricted in Power Platform admin center
C.Use Microsoft Entra ID conditional access policies
✓ D.Assign Dataverse security roles to users

Why D: Dataverse security roles control access to tables and records. Column-level security can be used for sensitive fields. Power Platform admin center manages environments but not fine-grained data access. SharePoint permissions are irrelevant.

Last reviewed: Jun 24, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.