Overview
Manage and secure Power BI is 15–20% of the PL-300 exam, the smallest domain, covering how reports are deployed, shared and governed in the Power BI service. It has two objective groups. Creating and managing workspaces and assets covers creating and configuring a workspace, configuring and updating an app, publishing and updating items, creating dashboards, choosing a distribution method, configuring subscriptions and data alerts, promoting or certifying content, identifying when a gateway is required, and configuring scheduled semantic model refresh. Securing and governing items covers assigning workspace roles, configuring item-level access and access to semantic models, implementing row-level security roles and group membership, and applying sensitivity labels.
The exam rewards knowing how to share content through workspaces and apps, keep data current with refresh and gateways, and secure data appropriately, especially row-level security, which restricts data by user. These governance skills complete the Power BI lifecycle after the data is prepared, modeled and visualized.
How it's tested
PL-300 questions in this domain describe a sharing, refresh or security need and ask which workspace, distribution, refresh or security feature fits. PL-300 questions are scenario-based and hands-on, so read the data situation and choose the Power BI feature, DAX pattern or configuration it points to before answering.
-
Share the content
A distribution need is described, and you choose the workspace, app or distribution method.
-
Keep data current
A refresh or connectivity need is described, and you choose scheduled refresh or a gateway.
-
Secure the data
An access or data-restriction need is described, and you choose workspace roles, item access or row-level security.
Regional managers must each see only their own region's data in the same report. Giving everyone the full report exposes all regions, and building separate reports per region is unmanageable. Implementing row-level security with roles that filter the data by the user's region, and assigning users to those roles, restricts each manager to their region within one report, which is the security feature the exam expects for per-user data restriction.
Functional groups 2
Official functional groups from the Microsoft outline, in outline order.
4.1 Create and manage workspaces and assetsWorkspaces, apps, distribution, refresh and gateways.
- What it means
- This covers creating and configuring a workspace, configuring and updating an app, publishing, importing or updating items, creating dashboards, choosing a distribution method, configuring subscriptions and data alerts, promoting or certifying content, identifying when a gateway is required, and configuring a semantic model scheduled refresh.
- What to understand
- Content is developed in workspaces and distributed to consumers, often through apps that package reports and dashboards. Scheduled refresh keeps imported data current, and an on-premises data gateway is required to refresh from on-premises or some private sources. Promoting or certifying content signals its trustworthiness. Choosing the right distribution method and refresh setup delivers content reliably.
- How it shows up
- A sharing or refresh need is described, and you must choose the workspace, app, distribution, refresh or gateway option.
- Common confusion
- Not knowing that a gateway is required to refresh from on-premises sources, or confusing an app with a workspace.
4.2 Secure and govern Power BI itemsWorkspace roles, item access, row-level security and sensitivity labels.
- What it means
- This covers assigning workspace roles (Admin, Member, Contributor, Viewer), configuring item-level access and access to semantic models, implementing row-level security roles, configuring row-level security group membership, and applying sensitivity labels.
- What to understand
- Security operates at several levels: workspace roles grant broad permissions within a workspace, item-level access shares specific items, and row-level security (RLS) restricts which rows of data a user sees based on their role, so different users see different data in the same report. Sensitivity labels classify and protect content. Row-level security is the most nuanced and heavily tested, filtering data per user.
- How it shows up
- An access or data-restriction need is described, and you must choose the workspace role, item access or row-level security.
- Common confusion
- Confusing workspace roles with row-level security; roles govern what you can do in the workspace, while RLS restricts which data rows you see.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Workspaces
Where content is developed and managed.
- Remember
- Collaboration containers.
- Tested as
- Workspace questions.
- Trap
- Confusing a workspace with an app.
-
Apps
Packaged content for consumers.
- Remember
- Distribute reports and dashboards.
- Tested as
- Distribution questions.
- Trap
- Confusing an app with a workspace.
-
Distribution methods
Apps, direct sharing, workspace access.
- Remember
- Choose by audience and scale.
- Tested as
- Distribution questions.
- Trap
- Picking the wrong method.
-
Scheduled refresh
Keeps imported data current.
- Remember
- Set a refresh schedule.
- Tested as
- Refresh questions.
- Trap
- Leaving data stale.
-
Data gateway
Connects the service to on-premises data.
- Remember
- Required to refresh on-premises sources.
- Tested as
- Refresh questions.
- Trap
- Forgetting the gateway requirement.
-
Promote and certify
Signal content trustworthiness.
- Remember
- Certify for endorsed content.
- Tested as
- Governance questions.
- Trap
- Not endorsing trusted content.
-
Workspace roles
Admin, Member, Contributor, Viewer.
- Remember
- Govern workspace permissions.
- Tested as
- Security questions.
- Trap
- Confusing roles with RLS.
-
Item-level access
Share specific items.
- Remember
- Grant access to one report or model.
- Tested as
- Security questions.
- Trap
- Over-sharing the workspace.
-
Row-level security
Restricts data rows by user role.
- Remember
- Different users see different data.
- Tested as
- Security questions.
- Trap
- Confusing with workspace roles.
-
RLS group membership
Assigning users or groups to RLS roles.
- Remember
- Drives who sees what data.
- Tested as
- Security questions.
- Trap
- Not assigning users to roles.
-
Sensitivity labels
Classify and protect content.
- Remember
- Apply data protection.
- Tested as
- Governance questions.
- Trap
- Overlooking labeling.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Workspace vs. app
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Workspace | Where creators build and manage content | For development and collaboration | Confusing with an app |
| App | Packaged content for consumers | For distribution | Confusing with a workspace |
Workspace roles vs. row-level security
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Workspace roles | What you can do in the workspace | Admin to Viewer permissions | Confusing with RLS |
| Row-level security | Which data rows you can see | Filters data per user | Confusing with workspace roles |
When a gateway is required
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Cloud source | Service refreshes directly | No gateway needed | Adding an unnecessary gateway |
| On-premises source | Needs a data gateway | Gateway bridges to the service | Forgetting the gateway |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Separate reports per group
- What candidates pick
- Build a separate report for each region so each sees only its data.
- Why it looks right
- It isolates the data.
- Why it's wrong
- Row-level security filters data by the user's role within one report, which is far more maintainable than many duplicate reports.
Clue to watch for Different users must see only their own subset of the same report's data.
-
No gateway for on-premises
- What candidates pick
- Schedule refresh from an on-premises database without a gateway.
- Why it looks right
- Refresh is configured.
- Why it's wrong
- An on-premises data gateway is required for the service to reach on-premises sources; without it the refresh fails.
Clue to watch for The data source is on-premises or behind a firewall.
-
Workspace role for data restriction
- What candidates pick
- Use the Viewer workspace role to limit which data rows a user sees.
- Why it looks right
- Both relate to access.
- Why it's wrong
- Workspace roles govern what you can do in the workspace; row-level security restricts which data rows you see.
Clue to watch for The need is to filter data per user, not grant workspace permissions.
-
RLS without members
- What candidates pick
- Create row-level security roles but not assign any users to them.
- Why it looks right
- The roles exist.
- Why it's wrong
- Users must be assigned to RLS roles (directly or via groups) for the filtering to apply to them.
Clue to watch for RLS is defined but users still see all data.
-
Share workspace for consumers
- What candidates pick
- Give report consumers access to the whole workspace.
- Why it looks right
- It grants them the content.
- Why it's wrong
- Consumers should receive a published app or specific item access, not broad workspace access meant for creators.
Clue to watch for The audience only needs to view the finished content.
Answer framework
For any Domain 4 scenario, use these steps to find the answer PL-300 expects.
- Develop content in a workspace and distribute it to consumers through an app or appropriate item-level access, choosing the method by audience.
- Keep imported data current with scheduled refresh, and add an on-premises data gateway when the source requires it.
- Promote or certify trustworthy content and configure subscriptions, alerts and dashboards as needed.
- Secure access with the right workspace roles for creators and item-level access for consumers.
- Restrict data per user with row-level security roles and group membership, and apply sensitivity labels for governance. Where two options seem to fit, choose the one that most precisely matches the scenario's data, message or requirement.
Practice question
Want more like this? The PL-300 practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Although this is the smallest domain, do not skip it, since it covers delivering and securing the solution and includes the heavily tested row-level security. Start with workspaces and distribution: understand the difference between a workspace (for creators) and an app (for consumers), and choose the right distribution method. Learn scheduled refresh and, importantly, when an on-premises data gateway is required.
Then master the security layers, keeping workspace roles (what you can do in the workspace) distinct from row-level security (which data rows you see). Row-level security is the most nuanced and tested: learn how roles filter data and how users are assigned to them, and remember that unassigned roles have no effect. Learn item-level access and sensitivity labels.
Because the exam tests the Power BI service, practice publishing, sharing, scheduling refresh and configuring row-level security in a workspace. This is the final domain, so finish with full practice tests across all four, and practice pacing for the 100-minute exam.
FAQ
How much of PL-300 is Domain 4?
Manage and secure Power BI is 15–20% of the exam, the smallest domain, covering deploying, sharing and securing Power BI content.
What is the difference between a workspace and an app?
A workspace is where creators develop and manage content collaboratively. An app is a packaged, polished collection of content published from a workspace for consumers to view, providing a cleaner distribution experience.
When is a data gateway required?
When the Power BI service needs to refresh or query data from an on-premises source or certain private sources. The on-premises data gateway bridges the cloud service to those sources; cloud sources generally do not need one.
What is row-level security?
A feature that restricts which rows of data a user can see based on their assigned role, so different users see different data within the same report. Roles define filters, and users are assigned to roles directly or through groups.
What is the difference between workspace roles and row-level security?
Workspace roles (Admin, Member, Contributor, Viewer) govern what a user can do within a workspace. Row-level security governs which rows of data a user can see in a report. They address different kinds of access.
Why might row-level security not take effect?
If users are not assigned to the row-level security roles, the filters do not apply to them. Roles must have members, assigned directly or via security groups, for the data restriction to work.
How does Domain 4 connect to the rest of the exam?
It delivers and secures the reports from Domain 3, built on the model from Domain 2 and the data from Domain 1, completing the Power BI lifecycle from raw data to governed, shared insight.
Test your Domain 4 knowledge
You have covered workspaces, distribution, refresh, gateways and security including row-level security. Test whether you can manage and secure Power BI under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the PL-300 AI tutor Get any concept explained your way