DP-600 · Question #131
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the
The correct answer is B. No. Even after enabling and deploying dynamic row-level security (RLS) for a semantic model, additional steps are likely required to ensure it correctly functions for users synced from an on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID.
Question
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with a Microsoft Entra tenant by using Microsoft Entra Connect. You have a Fabric tenant that contains a semantic model. You enable dynamic row-level security (RLS) for the model and deploy the model to the Fabric service. You query a measure that includes the USERNAME() function, and the query returns a blank result. You need to ensure that the measure returns the user principal name (UPN) of a user. Solution: You update the measure to use the USEROBJECTID() function. Does this meet the goal?
Options
- AYes
- BNo
How the community answered
(23 responses)- A13% (3)
- B87% (20)
Why each option
Even after enabling and deploying dynamic row-level security (RLS) for a semantic model, additional steps are likely required to ensure it correctly functions for users synced from an on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID.
Simply enabling and deploying dynamic RLS is often insufficient for synced users because their User Principal Name (UPN) or other identity attributes from Microsoft Entra ID might not precisely match the RLS filtering columns in the semantic model without explicit configuration or validation.
Merely enabling and deploying dynamic RLS might not be sufficient to ensure it works correctly for users synced from on-premises AD DS. The RLS implementation, typically using `USERPRINCIPALNAME()` or `USERNAME()` DAX functions, relies on the user's identity as seen by Power BI. This identity must accurately map to the filtering columns in the semantic model, and often, specific attention is needed to ensure UPN consistency or alternative mapping for synced user accounts to prevent RLS failures.
Concept tested: Dynamic RLS with synced users
Source: https://learn.microsoft.com/en-us/power-bi/enterprise/service-gateway-rls
Topics
Community Discussion
No community discussion yet for this question.