Power BI Service, Sharing and Security Interview Questions for Power BI
25 Power BI Service, Sharing and Security questions with answers for power bi roles — 6 easy, 12 medium, 7 hard.
About Power BI Service, Sharing and Security
After building comes publishing and governance. This topic covers workspaces and roles, apps and audiences, static and dynamic row-level security, object-level security, gateways, scheduled and incremental refresh, deployment pipelines, Git integration, endorsement, sensitivity labels, subscriptions, the XMLA endpoint and embedding reports for external users securely.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Row-level security restricts which rows of data a user can see in a semantic model. You define roles in Desktop with DAX filter expressions on tables, such as Store[Region] = "North", then assign users or security groups to roles in the Service. Filters propagate through relationships to fact tables. RLS applies to viewers; workspace Admins, Members and Contributors can see all data.
02
What is an on-premises data gateway and when is it needed?
The on-premises data gateway is software installed on a machine inside the company network that securely connects the Power BI Service to on-premises sources such as SQL Server, file shares or Oracle. It is needed for scheduled refresh and DirectQuery to those sources. Standard mode supports many users and is centrally managed; personal mode is for a single user. Cloud sources usually do not need a gateway.
03
What are subscriptions and data alerts in the Power BI Service?
Subscriptions email a snapshot of a report page or dashboard to users on a schedule, or after data refresh, with a link to the live content. Data alerts notify users when a value on a dashboard card, KPI or gauge tile crosses a threshold, such as daily sales below a target. Paginated reports support subscriptions with attachments like PDF or Excel. Power Automate can extend alerts into workflows.
In Desktop use Modeling, View as, select a role and optionally Other user with an email to simulate dynamic RLS, and check visuals show only expected rows. In the Service open the semantic model's Security settings, select a role and use Test as role. Test with real sample users from different regions and a user with no mapping, who should see no data, and confirm totals match expectations.
05
How do you set up scheduled refresh in the Power BI Service?
Open the workspace, select the semantic model's settings, and check Data source credentials and Gateway connection, mapping on-premises sources to a gateway. Then turn on Scheduled refresh, choose time zone, frequency and time slots, and add failure notification contacts. Pro allows up to 8 refreshes per day and Premium or Fabric capacity up to 48. Stagger refresh times to avoid source load peaks.
06
How do you manage multiple report requests from different departments with tight deadlines?
I log every request with its business goal, deadline and effort, and agree priorities with my manager instead of choosing alone. I reuse shared semantic models so new reports are faster, and I communicate realistic timelines early. In one quarter this helped me deliver eight reports, with two lower-priority ones moved by a week after discussion with requesters, without escalations.
07
What is the difference between static and dynamic RLS?
Static RLS hard-codes values in each role, such as one role per region, which becomes hard to manage as regions grow. Dynamic RLS uses one role with a filter based on the logged-in user, such as Users[Email] = USERPRINCIPALNAME(), with a security mapping table linking users to the regions or managers they may see. Dynamic RLS scales better and is driven by data rather than role edits.
08
What is the difference between sharing a report, publishing an app and using a workspace?
A workspace is where creators collaborate. Direct sharing gives one person or group access to a single report, which is quick but hard to govern at scale. An app packages reports and dashboards from a workspace for consumers, with audiences controlling who sees which content, and updates only when republished. Apps are the recommended way to distribute content to large business audiences.
Deployment pipelines move content through stages, typically Development, Test and Production workspaces. Creators deploy reports and semantic models from one stage to the next, compare differences, and use deployment rules to change data source connections or parameters for each stage. This supports controlled releases and testing before users see changes. They work alongside Git integration for version control in Fabric workspaces.
Incremental refresh partitions a large table by date so each refresh reloads only recent data, such as the last 10 days, while keeping older partitions, such as five years of history, unchanged. It uses the RangeStart and RangeEnd datetime parameters to filter the query, which must fold to the source. It cuts refresh time and load on sources, and can add a DirectQuery partition for real-time data.
11
What are endorsement, sensitivity labels and lineage view?
Endorsement marks content as Promoted by its owners or Certified by authorised reviewers, guiding users to trusted semantic models. Sensitivity labels from Microsoft Purview classify content, such as Confidential, and labels flow to exports like Excel and PDF. Lineage view shows how data sources, dataflows, semantic models, reports and dashboards depend on each other, which helps impact analysis before changes.
12
Each regional manager must see only their region, and the CEO must see everything. How do you implement this?
I would build dynamic RLS with a security table of Email and Region, related to the Region dimension, and a role filter Security[Email] = USERPRINCIPALNAME(). The CEO and other full-access users get an 'All' flag handled in the rule, or are placed in a separate role with no filter. I would test with View as role in Desktop and in the Service before publishing the app.
13
Scheduled refresh fails every night with a gateway error. How do you troubleshoot?
I would check the refresh history error details, confirm the gateway machine is on and the gateway service is running and updated, and verify data source credentials in the gateway connection have not expired. Then test connectivity from the gateway machine to the source and check that the source names in the model exactly match the gateway data source. Gateway logs and network or firewall changes are next.
14
Business users keep asking for edits directly in production reports. How do you set up a better process?
I would set up separate Development, Test and Production workspaces with a deployment pipeline, store PBIP files in Git, and route requests through a simple backlog. Changes are built in Dev, reviewed by a key user in Test and deployed to Production on a release schedule. Users consume through an app, so production stays stable and changes are traceable.
15
Tell me about a time you handled a data access or security issue.
Situation: a sales user reported seeing another region's numbers after a reorganisation. Task: fix the leak fast. Action: I confirmed the security mapping table had stale entries, removed the user from the wrong row, refreshed the model and then automated the mapping from the HR system with a daily refresh. I informed the data owner. Result: access stayed correct after later reorganisations, and quarterly access reviews were added.
16
How do you mentor junior Power BI developers in your team?
I pair with them on real tasks, review their models and DAX with clear reasons rather than just fixes, and share a short checklist covering star schema, naming, measures over columns and performance checks. I give them ownership of small reports early. One junior I mentored moved from building single-table reports to owning a shared finance model within six months.
17
Your workspace has grown to 150 items and nobody knows which reports are used. How do you clean it up?
I would export usage from the activity log or the workspace usage metrics, list items not viewed in 90 days and confirm with owners before archiving. Duplicate models are consolidated into shared semantic models, naming standards are applied, and workspaces are split by domain with clear owners. A quarterly review keeps it tidy. This also reduces refresh load on capacity.
18
How do you set up an app with different audiences?
In the workspace choose Create app or Update app, add the reports and dashboards, then in the Audience tab create audiences such as Sales Managers and Finance, choose which content each audience sees and grant access to the right Entra ID security groups. Publish the app and share the link. Remember RLS still controls rows inside reports; audiences only control which items are visible.
Object-level security hides entire tables or columns from specific roles, so users in that role cannot see or query them, for example hiding a Salary column from non-HR users. It is configured with Tabular Editor or similar external tools on the model's roles. Unlike RLS, which filters rows, OLS removes metadata access. Visuals using a secured object show an error for restricted users.
The XMLA endpoint exposes semantic models on Premium, PPU or Fabric capacity like an Analysis Services server. Tools such as Tabular Editor, DAX Studio, SQL Server Management Studio and ALM Toolkit can then read or write the model, manage partitions, refresh specific tables, script deployments and apply object-level security. Read-write mode must be enabled in capacity settings by an admin.
21
A manager must see their whole reporting hierarchy, not just their own team. How do you build RLS for that?
I would flatten the employee hierarchy with PATH(Employee[EmployeeID], Employee[ManagerID]) into a path column, then in the role filter use PATHCONTAINS(Employee[Path], LOOKUPVALUE(Employee[EmployeeID], Employee[Email], USERPRINCIPALNAME())). Each manager then sees every employee below them at any depth. I would test with a few known hierarchies and check performance on a large employee table.
22
Users export large amounts of sensitive data from reports to Excel. How do you control it?
I would review whether export is really needed and adjust export settings per report or at tenant level, for example allowing only summarised data. I would apply Purview sensitivity labels so exported files keep protection, use RLS and OLS to limit what can be exported, and monitor exports through the activity log. For legitimate detailed needs, a governed paginated report is better.
23
How do you configure incremental refresh on a sales table?
In Power Query create RangeStart and RangeEnd parameters of type Date/Time, and filter OrderDate so it is greater than or equal to RangeStart and less than RangeEnd. Confirm the step folds to the source. In Desktop right-click the table, choose Incremental refresh, set to archive, say, 5 years and refresh the last 10 days, optionally detect data changes. Publish, and the Service creates partitions on first refresh.
24
Write a dynamic RLS rule using a security mapping table.
// Security table: Email, Region; related to Region[Region]
// Role filter on Security table:
[Email] = USERPRINCIPALNAME()
// Optional all-access rule on Region table instead:
VAR u = USERPRINCIPALNAME()
RETURN
LOOKUPVALUE(Security[Region], Security[Email], u) = "ALL"
|| Region[Region] IN CALCULATETABLE(VALUES(Security[Region]), Security[Email] = u)
25
A report must be embedded in a customer-facing web portal for users without Power BI licences. What approach do you take?
I would use Power BI Embedded with the 'embed for your customers' pattern, also called app owns data. The application authenticates with a service principal, generates embed tokens and passes customer identity for RLS, so each customer sees only their data. It needs Fabric or embedded capacity. I would design RLS carefully, test token expiry and monitor capacity load as the customer base grows.
Frequently asked questions
How important is Power BI Service, Sharing and Security in Power BI interviews?
After building comes publishing and governance. This topic covers workspaces and roles, apps and audiences, static and dynamic row-level security, object-level security, gateways, scheduled and incremental refresh, deployment pipelines, Git integration, endorsement, sensitivity labels, subscriptions, the XMLA endpoint and embedding reports for external users securely.
How should I use the Power BI Service, Sharing and Security sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.