5.2. Secure and Govern Power BI Items
💡 First Principle: Security in Power BI is layered: workspace roles decide who can edit and manage, item permissions decide who can open specific content, semantic model permissions decide who can build on or query data, row-level security decides which rows each viewer sees, and sensitivity labels decide how data is classified and protected after it leaves. Each layer answers a different question, and exam scenarios name exactly one.
Why care? A single misplaced permission leaks data. Giving a viewer the Contributor role exempts them from row-level security; sharing a report with "allow recipients to build content" lets them query the whole model; publishing to web makes data public. The exam rewards precise knowledge of each layer's boundaries and the principle of least privilege.
The mental model is a building with layered security: the badge determines which floors you can enter (workspace roles and item access), the key card decides which rooms (semantic model permissions), the filing cabinet lock decides which folders you can read inside the room (RLS), and the CONFIDENTIAL stamp on documents travels with them when they leave the building (sensitivity labels).
⚠️ Common Misconception: Row-level security restricts everyone who opens the report. RLS applies only to users with Viewer role or read-only access through sharing or apps. Workspace Admins, Members, and Contributors can edit the model, so RLS doesn't filter their data.
