Workspaces, Apps, and Content Distribution

Introduction

This lesson opens the domain Manage and secure Power BI (15–20% of the PL-300 skills measured, outline dated April 20, 2026). Under "Create and manage workspaces and assets" the official outline covers: creating and configuring workspaces and apps, publishing, importing or updating items in a workspace, creating dashboards, choosing a distribution method (workspace, app, share), configuring subscriptions and data alerts, promoting or certifying Power BI content, and configuring a semantic model scheduled refresh together with the gateways it may require. The exam describes a team, an audience and a constraint ("analysts must edit, executives must only read, data lives on a SQL Server in the office") and asks which workspace role, distribution method or refresh setup fits. Microsoft does not publish the number of questions or the question-type mix; OnLevelUp mock exams use a 50-question practice length and an 80% practice target, neither of which is official nor equal to the 700/1000 passing score.

After this lesson you will be able to choose the right workspace role, publish and distribute content with the right mechanism, configure alerts and subscriptions, distinguish promotion from certification, and set up a scheduled refresh with or without a gateway.

Learning objectives

• Create a workspace, assign the four workspace roles correctly and explain what each role can do.
• Publish a report from Power BI Desktop and update or replace it afterwards.
• Build a dashboard by pinning visuals and explain how dashboards differ from reports.
• Choose between workspace access, an app, a sharing link, and other distribution methods.
• Configure subscriptions and data alerts and state their limits.
• Promote or certify a semantic model or report and explain who can do which.
• Choose between no gateway, an on-premises data gateway, a personal gateway and a virtual network data gateway, and configure a scheduled refresh.

1. Workspaces: the collaboration and storage unit

A workspace in the Power BI service is a container for related items: semantic models, reports, dashboards, dataflows, paginated reports and other Fabric items. Every user has My workspace, a personal sandbox that must not be used to share production content. Shared work goes into a regular workspace, created from Workspaces > New workspace. Key settings when you create one:

• Name and description, optionally a contact list for people to ask about the content.
• License mode: Pro, Premium per user (PPU), or a capacity (Premium / Fabric). The mode decides who can consume the content and which refresh limits apply (see section 7).
• Workspace image and default storage format, such as the large semantic model format for models above the default size limit.

Workspace roles

Access to a workspace is granted by assigning a user, a Microsoft Entra security group, or a Microsoft 365 group to one of four roles. Prefer groups: when someone changes team you update the group, not the workspace.

The last row is a classic exam trap: RLS roles filter data only for Viewers. Anyone who can edit the semantic model (Admin, Member, Contributor) bypasses RLS. Section 4 of the next lesson develops this.

Exam tip: the typical split is Contributor for analysts who build and publish but must not control who sees the content, Member for the team lead who publishes the app, Viewer for reviewers who only read, and Admin for the owner of the workspace.

Worked example: choose the roles

Statement. Contoso Retail has a "Sales Analytics" workspace. Requirements: (1) Priya, the BI lead, manages membership and deletes obsolete content; (2) three analysts edit reports and publish from Desktop but must not decide who sees content or update the app; (3) the regional managers (group Sales-Managers) must only open reports, and their data is restricted by RLS; (4) the lead may publish the app.

Reasoning.

1. Priya manages membership and deletes content: Admin.
2. Analysts edit and publish but cannot update the app or share: Contributor.
3. Managers must only read and must be filtered by RLS: Viewer, assigned to the Sales-Managers group.
4. Publishing the app is a Member (or Admin) capability. Priya already can; if a second person needs it, add them as Member, not Contributor.

Why not the alternatives. Giving analysts Member lets them share and update the app, violating (2). Giving managers Contributor would let them edit the semantic model and bypass RLS, violating (3). Giving managers an Admin role to "make it simple" exposes the entire workspace.

2. Publishing, importing, and updating items

From Power BI Desktop, Home > Publish sends the report and its semantic model to a chosen workspace. Publishing again to the same workspace with the same name replaces the report and the model (after a warning); the replaced content keeps its workspace URL, and dashboard tiles pinned from the report continue to work as long as the visuals still exist. Other ways to bring content into a workspace:

• Upload a file (.pbix, Excel, CSV) with New > Upload in the service.
• Get data from a connector directly in the service, which creates a semantic model.
• Import a paginated report (.rdl) or create items with other Fabric tools.
• Deployment pipelines promote content across Development, Test and Production workspaces, with rules that change data source parameters per stage. They need a capacity or PPU license and are the controlled way of updating production content.

A point often tested: when you republish a report whose data source credentials were already configured, they persist in the semantic model settings; but if the data source changes, credentials must be reconfigured. Also, a published live-connected report (to a shared semantic model) has no model of its own in the workspace: it uses the shared model, so refresh is configured once on the shared model.

Lineage view shows how items depend on each other (data source > semantic model > report > dashboard). Impact analysis lists the downstream reports and dashboards that would be affected by a change, and can notify their owners. Use both before changing a shared semantic model.

3. Dashboards

A dashboard is a single-page canvas of tiles created only in the Power BI service (not in Desktop). A tile is a pinned visual, a whole report page, a live report page, a text box, an image, a video, or a web content tile. Tiles may come from several reports and semantic models, which makes a dashboard the "one screen" overview.

A natural-language Q&A box can be shown on a dashboard to let readers ask questions, and a featured dashboard is the one opened by default. Dashboard tiles refresh when the underlying semantic model refreshes (typically within the hour for a scheduled refresh, quickly for DirectQuery or live connections).

Pitfall: a dashboard has no slicers. If the requirement is "let the reader filter by region", the answer is a report, not a dashboard.

4. Distribution methods

Power BI offers several ways to put content in front of consumers. The exam asks you to choose the one that respects the audience, the license and the governance constraints.

Apps and audiences. The workspace is a staging area; the app is the production surface. You select the content, define the navigation, and define one or more audiences that each see a chosen subset of the content (for example Sales reps see two reports, Leadership see all). Assign security groups to audiences so that membership changes do not require republishing the app. Publishing the app again pushes new changes to users; editing the workspace without updating the app changes nothing for consumers. Apps can be installed automatically for users, and an organizational app experience with audiences is also available in the Power BI mobile apps.

Dataflows and shared semantic models are distributed differently: a certified semantic model is discovered in the OneLake catalog and consumed through Get data > Power BI semantic models, which keeps one source of truth for many reports. Consumers need Build permission on the model, not workspace membership.

Worked example: pick the distribution method

Statement. The finance team publishes a monthly performance report. 1,200 employees across the company must read it; only finance leaders should also see a margin analysis page; nobody should see drafts. Content must stay inside the tenant, and adding new employees must not require touching the report.

Reasoning.

1. 1,200 consumers who only read: an app, not workspace access (which would also expose drafts and models).
2. Two different views: two audiences in the app (All staff with the performance report, Finance leaders with both).
3. Membership changes without republishing: assign Entra security groups to audiences.
4. Stays inside the tenant: not Publish to web.
5. Consumers who lack Pro licenses can read it if the workspace is on a capacity with the right license mode (otherwise they need Pro or PPU).

Why not the alternatives. Sharing links to 1,200 people is unmanageable and gives no audiences. Workspace Viewer access shows drafts and every item. Publish to web is public and unsecured.

5. Subscriptions and data alerts

Subscriptions send an e-mail with a snapshot (image, link, and optionally an attachment) of a report page or dashboard on a schedule, or after the data refresh. You can subscribe yourself, and report authors with the right permission can subscribe others. Key points:

• Frequency: daily, weekly, hourly (service-level limits apply), or "after data refresh" when the model refreshes.
• The snapshot is generated with the subscriber's permissions, so RLS applies according to the subscriber.
• A subscription requires a Pro or PPU license, or content in a capacity that allows free users to view it.
• Subscriptions are stopped when the owner leaves or when the report is changed so that the subscribed page no longer exists.

Data alerts notify you when a value crosses a threshold. They are set on dashboard tiles of type card, KPI or gauge (and some single-value visuals), in the service or in the Power BI mobile app. Alerts are evaluated when the data refreshes (about once per hour for imported data), can send a notification in the notification center and optionally an e-mail, and can trigger a Power Automate flow. They do not work on report visuals and not on streaming tiles in the same way, and they are not available on tiles containing multiple values such as a clustered column chart.

Worked example: configure an alert

Statement. A warehouse manager wants to be e-mailed whenever the Orders waiting > 48 h card on the "Operations" dashboard exceeds 25.

Solution. In the service, open the dashboard, select the ellipsis (...) on the card tile, choose Manage alerts > Add alert rule, set the condition Above and the threshold 25, enable Send me email, and save. The alert is evaluated after each data refresh. If the card was created on a report page and not pinned, it cannot hold an alert: it must first be pinned to a dashboard.

6. Promoting and certifying content

Endorsement helps users find trusted content. There are three states:

A third kind, Master data (Fabric), labels the authoritative source for a type of data. Endorsement applies to semantic models, reports, apps, dataflows and other items, and endorsed items rank higher in search and in the OneLake catalog. Endorsement does not grant access to anyone. It is purely a signal.

Exam tip: "certify" always means an authorized reviewer, never the author; "promote" is self-service. If a question says the author wants other analysts to prefer the dataset without a formal review, the answer is promote.

7. Gateways and scheduled refresh

An Import semantic model contains a copy of the data; it must be refreshed to stay current. Scheduled refresh is configured in the service under Semantic model > Settings > Refresh. Before it can run, each data source needs valid credentials, and sources that Power BI cannot reach from the cloud need a gateway.

Do I need a gateway?

After installing a standard gateway, register it, then in the semantic model settings under Gateway connection map each data source to a gateway data source (with its credentials and privacy level). The semantic model and the data source definition must match (server and database names, same casing) or the mapping fails.

Refresh limits and behavior

• Pro/PPU: up to 8 scheduled refreshes per day; Premium / Fabric capacities: up to 48 per day. The XMLA endpoint and APIs allow programmatic refreshes within capacity limits.
• A scheduled refresh that fails repeatedly (four consecutive failures) or is on a model not used for two months can be disabled automatically; the owner is notified by e-mail.
• Large imported tables benefit from incremental refresh, which refreshes only recent partitions after an initial full load; it requires a date/time column and the RangeStart / RangeEnd parameters in Power Query.
• DirectQuery and live connections do not need a scheduled refresh of data (only of the metadata cache of tiles, by default every hour), but they need the gateway to be available at query time for on-premises sources.

Worked example: fix a failing refresh

Statement. A semantic model imports from an on-premises SQL Server and from an Azure SQL Database. The scheduled refresh fails with "credentials are not valid for the data source". The analyst's Desktop works because the user is on the corporate network. A standard gateway is installed and online.

Reasoning.

1. Azure SQL is a cloud source: it needs credentials but no gateway.
2. The on-premises SQL Server needs the gateway: in Settings > Gateway connection, turn on the gateway and map the SQL Server data source to it.
3. Enter the credentials (Windows or Basic) and the privacy level on the mapped gateway data source.
4. Trigger Refresh now to test, then keep the schedule.

Why not the alternatives. Installing a personal gateway works only for the individual and breaks when that user is away. Switching to DirectQuery changes the model's behavior and performance and is not necessary. Asking users to refresh manually does not meet a scheduled-refresh requirement.

8. Pitfalls and exam tips

• A Contributor cannot update the app; Member can. Only Admin can add other admins.
• RLS applies to Viewers only. Do not give Contributor to a person who must be filtered.
• Publish to web is public; it is almost never the right answer for company data.
• Dashboards have no slicers, are created in the service, and are the only place for data alerts.
• Certified needs an authorized reviewer; promoted does not.
• A gateway is needed for on-premises sources, not for Azure SQL Database or SharePoint Online.
• Personal mode is for a single user, not for shared production content.
• Editing a workspace report does not change the app until the app is republished.
• A subscription is for scheduled e-mails; an alert is for thresholds.
• Prefer groups over individuals for roles and audiences.

9. Mini case study

Situation. Northwind Logistics keeps shipment data in an on-premises SQL Server and exchange rates in an Excel file on SharePoint Online. The BI team (4 people) builds a "Shipments" report; 300 dispatchers need to read it daily; 15 regional directors need an additional "Cost per route" page; the CFO wants a weekly e-mail with the key page; the operations manager wants a warning when late deliveries exceed 5% on a card; the team lead wants other analysts to reuse the semantic model, which has been reviewed by the data governance office.

Questions. Which roles, distribution and settings?

Solution (commented).

1. Roles. The 4 builders: Contributor (the team lead: Member so that they publish the app). The workspace owner: Admin. Dispatchers and directors are not workspace members.
2. Distribution. Publish an app with two audiences: Dispatchers (Shipments report) and Directors (Shipments and Cost per route), each assigned a security group. Drafts remain private in the workspace.
3. Refresh. The SQL Server needs a standard on-premises gateway with a mapped data source; SharePoint Online is a cloud source and only needs credentials. Schedule refreshes within the license limit (8 per day on Pro, 48 on a capacity).
4. CFO. A subscription to the key page, weekly, or after refresh.
5. Operations manager. Pin the late-delivery card to a dashboard and create a data alert above 5%.
6. Reuse. The governance office certifies the semantic model (the lead can only promote it); other analysts build new reports with Get data > Power BI semantic models, which needs Build permission.

Common wrong answers. Giving all 300 dispatchers Viewer on the workspace (exposes drafts and models); using Publish to web for convenience; installing the gateway in personal mode; letting the lead certify their own model.

Key terms

• Workspace: container for collaborative Power BI items.
• Workspace role: Admin, Member, Contributor or Viewer.
• App: curated package of content published from a workspace to consumers, with audiences.
• Audience: subset of app content visible to specific users or groups.
• Dashboard: single-page canvas of pinned tiles, created in the service.
• Tile: a pinned element on a dashboard.
• Subscription: scheduled e-mail snapshot of a report page or dashboard.
• Data alert: threshold notification on a dashboard tile.
• Endorsement: promoted or certified status of an item.
• On-premises data gateway: bridge between the service and on-premises sources.
• Scheduled refresh: recurring reload of an imported semantic model.
• Incremental refresh: partition-based refresh of recent data only.

Summary checklist

• I can name what Admin, Member, Contributor and Viewer can do, and that RLS only filters Viewers.
• I can publish and update content and explain what replaces what.
• I know dashboards are single-page, service-only, slicer-free and host data alerts.
• I can choose between workspace access, app, share link, embed and Publish to web.
• I can configure audiences using security groups.
• I can set up subscriptions and alerts and state their limits.
• I can distinguish promoted from certified content.
• I can decide when a gateway is required and which type to use.
• I know the refresh limits (8 vs 48 per day) and how to configure credentials.

Official sources

• Study guide for Exam PL-300: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/pl-300 (opens in a new tab)
• Roles in workspaces in Power BI: https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-roles-new-workspaces (opens in a new tab)
• Workspaces in Power BI: https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-new-workspaces (opens in a new tab)
• Power BI apps: https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-create-distribute-apps (opens in a new tab)
• Data alerts: https://learn.microsoft.com/en-us/power-bi/create-reports/service-set-data-alerts (opens in a new tab)
• Endorsement: https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-endorse-content (opens in a new tab)
• On-premises data gateway: https://learn.microsoft.com/en-us/data-integration/gateway/service-gateway-onprem (opens in a new tab)
• Data refresh in Power BI: https://learn.microsoft.com/en-us/power-bi/connect-data/refresh-data (opens in a new tab)