PL-300: Manage & Secure Power BI Domain

Most candidates in Bengaluru and Hyderabad spend 80% of their PL-300 prep building visuals and writing DAX. Then they hit the "Manage and secure Power BI" domain - worth roughly 15-20% of the exam - and lose marks they should never have lost. This domain is less about clicking around in Power BI Desktop and more about understanding how content is shared, secured and refreshed in the Power BI Service. Get it right and you bank easy points.

This guide covers everything Microsoft tests in 2026: workspaces, apps, row-level security (RLS), sensitivity labels, and scheduled refresh.

Workspaces vs. "My Workspace"

A workspace is a collaboration container in the Power BI Service. The exam loves to test the difference between personal and shared content.

• My Workspace - personal, not for team content. If a question describes a developer building reports only they use, this is the answer.
• Shared workspaces - where a team (say, a Pune analytics squad) co-develops semantic models, reports and dashboards.

Know the four workspace roles cold, because question stems map directly to them:

Exam trick: if someone needs to edit reports but must not publish the app, the answer is Contributor, not Member.

Apps: packaging content for the business

An app is a read-only, polished bundle of dashboards and reports published from a workspace to consumers. Picture a kirana-chain head office: the analytics team builds in a workspace, then publishes a "Daily Store Sales" app to 200 store managers who only consume it.

Key points the exam checks:

• Apps are how you distribute to large audiences, not by sharing individual reports.
• Audiences (multiple audience groups in one app) let you show different pages to different viewer groups - e.g., regional managers see their zone only.
• Updating an app requires re-publishing; changes in the workspace are not live until you click Update app.

Row-Level Security (RLS)

RLS is the single most tested security concept on PL-300. It restricts rows of data a user can see, based on their identity.

How it works

1. In Power BI Desktop, go to Modeling > Manage roles.
2. Create a role and add a DAX filter on a table.
3. Publish, then in the Service assign members (users/security groups) to the role.

Static vs. dynamic RLS

• Static RLS - hard-coded filter. Example for a "South" role on a cab-demand dataset:

[Region] = "South"

• Dynamic RLS - one role filters by the logged-in user using USERPRINCIPALNAME(). You keep a mapping table (user email → region):

[Region] = LOOKUPVALUE(
    UserRegion[Region],
    UserRegion[Email], USERPRINCIPALNAME()
)

Dynamic RLS scales: one role serves a UPI-transactions report across every state manager without 28 separate roles.

Exam essentials:

• RLS roles are created in Desktop, assigned in Service.
• Test with "View as role" in Desktop.
• RLS does not apply to Admins/Members editing the model - only to viewers and via apps.
• RLS filters rows; it does not hide columns or measures.

Sensitivity labels (Microsoft Purview)

Sensitivity labels classify and protect content - e.g., Confidential, Highly Confidential. They flow with the data: export a labelled report to Excel or PDF and the label (and its encryption) travels with the file.

What to remember:

• Labels are defined in Microsoft Purview, applied in Power BI.
• They enforce encryption and access, unlike RLS which only filters rows.
• A label persists across export, which is why a finance dashboard at an Indian bank stays protected even after download.

Know the distinction the exam draws: RLS = who sees which rows; sensitivity labels = how the data is classified and protected when it leaves Power BI.

Gateways and scheduled refresh

Cloud-only data (e.g., a SQL database in Azure) refreshes natively, but on-premises sources - a SQL Server in a Gurugram data centre - need a data gateway.

• On-premises data gateway (standard) - shared, enterprise, supports scheduled refresh and DirectQuery.
• Personal mode - single user, import only.

Scheduled refresh keeps imported data current:

• Set frequency (up to 8 times/day on Pro, 48 on Premium/Fabric capacity).
• Configure credentials for each data source.
• Set failure notifications so the owner gets an email when a 6 AM refresh breaks.

Common exam scenario: "A report built on an on-prem SQL Server fails to refresh in the Service." The fix is almost always install/configure a data gateway and map credentials.

A 5-point revision checklist

1. Workspace roles - Viewer / Contributor / Member / Admin, and which can publish an app.
2. App audiences - different pages for different groups from one app.
3. RLS - static vs. dynamic, USERPRINCIPALNAME(), created in Desktop / assigned in Service.
4. Sensitivity labels - classification + encryption that survives export, defined in Purview.
5. Gateways + refresh - on-prem needs a gateway; know refresh frequency limits and failure alerts.

Why this matters for your career

In India, the analysts who get promoted to BI Lead (₹14-22 LPA) are the ones who own governance, not just visuals. Knowing RLS and workspace strategy is exactly what an interviewer in a product company probes after they confirm you can write DAX. PL-300 is your proof on paper; understanding why these controls exist is your proof in the room.

Drill these concepts as scenario questions, not flashcards - the exam never asks "what is RLS," it asks "a manager in Chennai should only see Chennai sales; what do you configure?" Train on that format.

Related: Top 25 Power BI Interview Questions with Real Answers · Take a PL-300 mock exam

Don't just read. Prove your skill on DevWithData.