I85PREP
⌘ K
DP-500 study materials
DP-500 study resources

DP-500: Implement and manage data governance and security

DP-500 · Work through your exam, one topic at a time.

All guide sections

Implement and manage data governance and security

Domain 2 - Implement and manage data governance and security

This domain tests governance with Microsoft Purview plus defense-in-depth inside Synapse and Power BI: who can see which rows, columns, and labels, and how lineage is tracked end to end.

Microsoft Purview

  • The Data Map stores assets discovered by scanning sources through a self-hosted or Azure integration runtime; credentials should live in Azure Key Vault.
  • Collections are the permission boundary: a collection's permissions flow down to child collections.
  • Classification uses built-in and custom regex rules; sensitivity labels come from Microsoft Purview Information Protection and can be applied automatically.
  • Lineage flows from Data Factory/Synapse pipelines into Power BI when the workspace is connected and scanned.

Synapse security layers

  • Azure RBAC controls the control plane (create/manage resources); Synapse RBAC controls artifacts (pipelines, notebooks, SQL scripts); SQL permissions control data inside pools.
  • Row-level security uses an inline table-valued predicate function plus CREATE SECURITY POLICY.
  • Column-level security with GRANT SELECT (col) ON ...; dynamic data masking with MASKED WITH (FUNCTION='default()').
  • Serverless access is governed by database scoped credentials, external data sources, and managed identity.

Power BI security

  • Workspace roles: Admin, Member, Contributor, Viewer. Build permission on a dataset allows report creation against a shared semantic model.
  • RLS roles use USERPRINCIPALNAME() for dynamic rules; validate with "View as role"; assign Microsoft Entra groups in the service.
  • Object-level security hides tables or columns and must be set with external tooling such as Tabular Editor.
  • Sensitivity labels applied in Power BI inherit from labeled sources and travel with exported files.

Worked example

A shared semantic model must restrict regional managers to their own region. Add a role with a filter on the region mapped through USERPRINCIPALNAME(), test it in Desktop, publish, then map Entra security groups to the role. Reasoning: dynamic RLS keeps the model maintainable as managers change. Note that workspace Admins, Members, and Contributors bypass RLS; distribute through an app so consumers get Viewer-level access only.

Traps

  • Assuming RLS protects workspace editors; it does not.
  • Forgetting that masking does not apply to users with UNMASK or sysadmin.
  • Registering a source in Purview without granting the scanning identity read access.
  • Applying labels only in the source and expecting them to appear without scanning.