Manage and secure Power BI

You manage a Power BI workspace that contains several reports and a shared semantic model for the finance team. A group of business analysts needs to open and interact with the existing reports (using slicers and filters) but must not be able to edit, delete, publish, or reshare any content. You want to grant this access with the least privilege while assigning a single workspace role. Which workspace role should you assign to the analysts?

You publish a semantic model to a workspace backed by Power BI Pro (shared capacity). The model imports data from an on-premises SQL Server through a data gateway. Business users need the data updated frequently throughout the business day, and you configure scheduled refresh. When you try to add refresh times, you find you cannot schedule more than eight refreshes in a single day. What is the most appropriate action to allow more frequent scheduled refreshes?

Your organization has a widely reused sales semantic model published to a Power BI workspace. The Center of Excellence has formally reviewed and validated the model as the authoritative source for company reporting. They want it to appear with a special badge in the OneLake data hub and the Datasets list so report authors trust it as the official version. As a workspace admin, what should you do to apply the highest level of trust indicator, and who must ultimately authorize it?

You publish a dashboard that includes a card visual tracking daily total revenue. The finance director wants to be notified automatically whenever total revenue on that card falls below $50,000, and she wants the notification pushed to the Power BI mobile app on her phone. What should you configure?

You publish a dashboard to a Power BI workspace backed by a Premium capacity. You need to share the dashboard with a partner organization's user whose email is on a different Azure AD tenant. The partner must be able to view the dashboard but not modify it, and your organization has already enabled external sharing in the tenant admin settings. What is the correct approach?

You manage a Power BI workspace containing several dashboards and reports. The finance director asks to receive an automatic email every Monday morning that includes a static image of a specific dashboard so she can review key metrics before her weekly meeting, without opening Power BI. You have Pro licenses for all involved users. What should you configure to meet this requirement with the least administrative effort?

A colleague who published a semantic model to a Power BI workspace has left the company, and their account has been disabled. The model's scheduled refresh is now failing because the stored data source credentials belonged to that person. You are a Member of the workspace and need to get scheduled refresh working again with your own credentials, with the least administrative effort. What should you do first?

You manage a semantic model that imports 5 years of sales transactions, totaling over 200 million rows, from an Azure SQL Database. Full daily refreshes now exceed the refresh time window and frequently fail. Only the most recent 10 days of data ever changes at the source; older data is static. You must reduce refresh duration and reliability issues while keeping historical data available. What should you configure?

Your team maintains a Power BI workspace named 'Sales Analytics Prod' that already contains published reports and semantic models used by hundreds of users. You want to introduce a structured release process using a deployment pipeline with Development, Test, and Production stages, without disrupting the existing content or its consumers. What is the correct approach to bring the existing production workspace into a deployment pipeline?

Your team uses a Power BI deployment pipeline with Development, Test, and Production stages. Before promoting content from Test to Production, a governance policy requires you to verify exactly which reports and semantic models differ between the two stages. Which capability should you use to identify these differences without opening each item individually?

You publish a Power BI app to 200 users in the Sales workspace. Two weeks later you update a report's layout and correct a measure in the underlying semantic model. Business users report they still see the old version of the report. What must you do so the changes reach the app audience?

Your organization uses a Power BI deployment pipeline with Development, Test, and Production stages, each mapped to a separate workspace. A group of report developers must be able to build content and promote items from Development to Test, but they must NOT be able to deploy to the Production stage or modify content in the Production workspace. Only two release managers should perform deployments into Production. What is the recommended way to enforce this?

Your team uses a Power BI deployment pipeline with Development, Test, and Production stages. A semantic model in Development has three row-level security (RLS) roles defined, each with DAX filter expressions but no members assigned. After deploying to Test, a security administrator manually assigns Azure AD security groups to each role in the Test workspace. The next week you deploy an updated model from Development to Test again. What happens to the RLS role membership assignments in the Test stage after this second deployment?

Your team uses a Power BI deployment pipeline with Development, Test, and Production stages. A developer has finished validating a semantic model and report in the Test stage. The changes must now be moved to Production, but only the report has been modified since the last deployment—the semantic model is unchanged. You want the fastest deployment while ensuring the Production semantic model's existing data source connection and scheduled refresh settings are preserved. What should you do?

You manage a Power BI semantic model containing a Sales fact table and a SalesRep dimension table that includes an Email column matching each rep's Microsoft Entra sign-in address. Company policy requires that each of the 400 sales reps see only the rows for their own sales when viewing a published report, and management wants to avoid creating and maintaining a separate security role for every individual rep. What is the most efficient way to implement this requirement?

Your organization runs scheduled refresh for several semantic models that connect to an on-premises SQL Server through a single on-premises data gateway (standard mode) installed on one server. During recent maintenance windows on that server, all refreshes failed and reports showed stale data. You must ensure refreshes continue to succeed even if one gateway machine is offline, with the least ongoing administrative effort. What should you do?

A colleague publishes a report that connects to an on-premises SQL Server through an existing enterprise data gateway. When they attempt to configure scheduled refresh, the SQL Server data source does not appear in the list of available gateway connections, even though you (the gateway admin) have already created that data source on the gateway. What must you do so the colleague can bind their semantic model to the gateway data source?

A finance team publishes a semantic model that combines data from an on-premises SQL Server database and a SharePoint Online list. An on-premises data gateway (standard mode) is already installed and running. When the analyst configures scheduled refresh, the SQL Server source shows a valid gateway data source mapping, but the SharePoint Online source displays a warning that no gateway connection is available. The analyst must enable scheduled refresh for the entire model with the least administrative effort. What should the analyst do?

Your team publishes several reports to a shared Power BI workspace. The underlying data comes from an on-premises SQL Server database. Multiple analysts need to configure and manage scheduled refresh for their own reports, and the connection must remain available even when individual team members are on leave. Which gateway configuration should you deploy?

You publish a certified semantic model to a workspace where the sales analytics team members hold the Viewer role. One analyst, Priya, needs to build her own reports from this model and share those reports with colleagues who are not in the workspace. You want to grant only what is necessary without adding Priya to a higher workspace role. Which permission(s) should you grant Priya on the semantic model?