nerdexam
Microsoft

PL-300 · Question #67

You have a Power BI report that is configured to use row-level security (RLS). You have the following roles: - A manager role that limits managers to see only the sales data from the stores they…

The correct answer is B. In the access token for the application, include the user name and the role name. To enforce Row-Level Security (RLS) when embedding a Power BI report into an application, the embed token must include the user's effective identity and RLS roles.

Submitted by tarun92· Apr 18, 2026Manage and secure Power BI

Question

You have a Power BI report that is configured to use row-level security (RLS). You have the following roles:

  • A manager role that limits managers to see only the sales data from

the stores they manage

  • A region role that limits users to see only the data from their

respective region You plan to use Power BI Embedded to embed the report into an application. The application will authenticate the users. You need to ensure that RLS is enforced when accessing the embedded report. What should you do?

Options

  • AFrom dev.powerbi.com/apps, register the new application and enable the Read All Reports API
  • BIn the access token for the application, include the user name and the role name.
  • CFrom dev.powerbi.com/apps, register the new application and enable the Read All Groups API
  • DIn the access token for the application, include the report URL and the Microsoft Azure Active

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    72% (18)
  • C
    16% (4)
  • D
    8% (2)

Why each option

To enforce Row-Level Security (RLS) when embedding a Power BI report into an application, the embed token must include the user's effective identity and RLS roles.

AFrom dev.powerbi.com/apps, register the new application and enable the Read All Reports API

Enabling 'Read All Reports API' grants permissions to read reports but does not provide the specific user and role context needed to enforce RLS within the embedded report.

BIn the access token for the application, include the user name and the role name.Correct

When embedding Power BI reports with Row-Level Security (RLS) enabled, the application must generate an embed token that includes the effective username and the specific RLS role names the user should be assigned. This allows the Power BI service to apply the correct data filters based on the RLS rules defined in the report.

CFrom dev.powerbi.com/apps, register the new application and enable the Read All Groups API

'Read All Groups API' is for managing Power BI groups and is not related to enforcing RLS for individual users within an embedded report.

DIn the access token for the application, include the report URL and the Microsoft Azure Active

Including the report URL is part of identifying the report, but the crucial step for RLS enforcement is to pass the effective username and role names within the embed token, not just general Azure Active Directory information or the report URL itself.

Concept tested: Power BI Embedded RLS enforcement with tokens

Source: https://learn.microsoft.com/en-us/power-bi/developer/embedded/row-level-security

Topics

#Power BI Embedded#Row-Level Security (RLS)#Embed Token#Application Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PL-300 Practice