Publishing an app versus storing PBIX files in a shared folder in Microsoft OneDrive.

[AndyHermle]

Dear Experts: 

I am currently preparing for the PL-300 exam. I have got a sample test question that is as follows: 

The question explicitly says Administrative effort must be minimized, hence Answer C would be the right choice. Am I right?

Help is very much appreciated. Thank you very much in advance

------------------------------------

You have a Power BI tenant that contains a workspace named WS1. WS1 contains the following items:

• A semantic model named SM1.
• A report named RPT1 that is connected to SM1.
• A report named RPT2 that is connected to SM1.
• A report named RPT3 that is connected to SM1.
• A dashboard named DB1 that contains content from RPT1 and RPT2.

You need to grant workspace access to a group named Group1. The solution must meet the following requirements:

• Group1 must be able to view RPT1, RPT2, and DB1.
• Group1 must be prevented from viewing RPT3.
• Group1 must be prevented from creating new reports and dashboards by using SM1.
• Group1 must be prevented from sharing the reports and dashboards to other users.
• Administrative effort must be minimized.

What should you do?

• A. Publish an app. Most Voted
• B. Assign Group1 the Viewer role for WS1.
• C. Store PBIX files in a shared folder in Microsoft OneDrive.
• D. Share each item individually.

[AndyHermle]

Dear Jonvoge, 

thank you very much for your expert help. I was expecting such an answert, i.e. that this wording is so bad that no expert can give a definite answer. Thank you very much for the insights. Great help. 

Best Regards, Andreas

[Jonvoge · Accepted solution]

Argh. Yet another poorly worded question.
I will go ahead and say, that there is no way to 100% determine the right answer, all due to the sentence:

"You need to grant workspace access to a group named Group1." 

But we can deduce what Microsoft likely wants us to answer.

If we take the sentence above literally, to mean that the Users need to be able to see and access the Workspace from their list of Workspaces in the left-side navbar on app-powerbi.com, then the answer can never be A, C or D.

B could work, but in order to satisfy the criteria Group1 must be prevented from viewing RPT3, we would in addition to the Viewer role need to set up RLS for RPT3, and then not add this group of users to a RLS rule. 

However, as RPT3 uses the same model as RPT1 and RPT2, and since RLS is configured at model level and not report level, this is not possible, ruling out Option B as well, and resulting in no correct answers available.

Now if we forget that sentence mentioned above, and only focus on the sub-requirements: 

• Group1 must be able to view RPT1, RPT2, and DB1.
• Group1 must be prevented from viewing RPT3.
• Group1 must be prevented from creating new reports and dashboards by using SM1.
• Group1 must be prevented from sharing the reports and dashboards to other users.
• Administrative effort must be minimized.

We already established that Option B will not work.

Option C will also not work. Dashboards items can't be saved to OneDrive.

Option D could work, but this requires heavy Administrative work.

Option A could work, if we ignore the whole Workspace Access thing, as that is the one thing this option can't grant. With option A, we can share RPT1, RPT2 and DB1 with endusers, without granting Reshare and Build Permissions, and controlling access in a single place.

TL;DR:

Option A is likely the correct answer, but it hinges on us taking the question too literally, as the option will not grant users actual Workspace access.

_____________________________________________________
I hope my comment was helpful.
If your question was answered, please mark your post as 'Solved' and consider giving me a 'Thumbs Up'.
Find me on LinkedIn, Sessionize, or my blog Downhill Data