QUESTION 176 Hotspot Question You have a hybrid tenant in Microsoft Azure Active Directory (AD), part of Microsoft Entra, that syncs by using Azure AD Connect. You are building a dataset by using…

This question tests knowledge of how to implement Object-Level Security (OLS) in Power BI when users are sourced from a hybrid on-premises Active Directory (synced via Azure AD Connect), requiring the correct tool for OLS configuration and the correct DAX identity function to…

Implement and manage data models

Question

QUESTION 176 Hotspot Question You have a hybrid tenant in Microsoft Azure Active Directory (AD), part of Microsoft Entra, that syncs by using Azure AD Connect. You are building a dataset by using Power BI Desktop. The dataset will be deployed to the Power BI service. You need to implement object-level security (OLS) based on a table named User Corporate Role that contains the following two columns: - User: Contains user identities synced from on-premises Active Directory in the form of Domain\user - Corporate Role: A text column What should you use to configure OLS, and which Power BI function should you use to retrieve the user identities? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation

Approach. OLS cannot be configured through the standard Power BI Desktop UI - it must be configured using an external tool such as Tabular Editor (v2 or v3), which connects to the data model and allows setting OLS permissions on tables and columns via the XMLA endpoint. For the identity function, because the User Corporate Role table stores identities in Domain\user format (the on-premises AD format preserved by Azure AD Connect), you must use USERNAME() rather than USERPRINCIPALNAME(). USERNAME() returns the identity in Domain\user format matching the synced on-premises accounts, while USERPRINCIPALNAME() returns the UPN (email-style, e.g., [email protected]), which would not match the values in the table. The DAX security filter in the OLS role would compare USERNAME() against the User column in the User Corporate Role table to resolve the correct Corporate Role for each user.

Concept tested. Object-Level Security (OLS) configuration in Power BI requires an external tool (Tabular Editor) since it is not exposed in the Desktop UI. In hybrid Azure AD environments where on-premises AD identities are synced via Azure AD Connect, USERNAME() returns the Domain\user format needed to match synced identities, while USERPRINCIPALNAME() returns the cloud UPN format and would fail to match on-premises-style identity strings.

Reference. Microsoft Learn - Implement object-level security (OLS) in Power BI; Power BI DAX functions USERNAME() and USERPRINCIPALNAME(); Azure AD Connect hybrid identity documentation

Topics

#Object-Level Security#Power BI DAX Security#Tabular Editor#Hybrid Identity

Community Discussion

No community discussion yet for this question.

Full DP-500 Practice