Tag: Data Governance

Create and manage reference/static data in source control (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement CI/CD by using SQL Database Projects
      --> Create and manage reference/static data in source control


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

A database solution consists of more than just tables, views, stored procedures, and security objects. Many applications also depend on reference data (sometimes called lookup data) or static data that rarely changes but is essential for application functionality.

Examples include:

  • Country codes
  • Currency codes
  • Product categories
  • Sales territories
  • Tax rates
  • Department lists
  • User roles
  • Status codes
  • ISO language codes

In modern DevOps practices, this data should be managed alongside the database schema using source control. Keeping reference data under version control ensures that every environment—development, testing, staging, and production—contains the correct data required by the application.

For the DP-800 exam, Microsoft expects candidates to understand how to manage static data within SQL Database Projects and CI/CD pipelines, including deployment strategies, version control practices, and synchronization techniques.


What Is Reference (Static) Data?

Reference data is information that changes infrequently and is used repeatedly by applications to enforce consistency and business rules.

Examples include:

TableExample Values
CountriesUSA, Canada, Mexico
OrderStatusPending, Processing, Shipped
PaymentTypesCash, Credit Card, ACH
DepartmentsSales, HR, Finance
PriorityLevelsLow, Medium, High

Unlike transactional data, reference data is generally created by administrators rather than users.


Characteristics of Reference Data

Reference data is typically:

  • Small in volume
  • Read frequently
  • Updated infrequently
  • Shared across applications
  • Required for business logic
  • Consistent across environments

Because it changes rarely, it is well suited for storage in source control.


What Is Source Control?

Source control (also called version control) tracks changes to files over time.

Common source control systems include:

  • Git
  • Azure Repos
  • GitHub
  • GitLab

Within SQL Database Projects, source control stores:

  • Database schema
  • Stored procedures
  • Views
  • Functions
  • Security objects
  • Deployment scripts
  • Reference data scripts

Why Store Reference Data in Source Control?

Managing static data in source control provides several benefits:

  • Consistent deployments
  • Reproducible environments
  • Complete change history
  • Easier collaboration
  • Simplified rollback
  • Automated deployments
  • Reduced configuration drift

Without version-controlled reference data, development and production environments can become inconsistent.


Configuration Data vs. Reference Data

Candidates should understand the distinction.

Reference Data

Business information used by applications.

Examples:

  • Product categories
  • Country codes
  • Payment methods

Configuration Data

Controls application behavior.

Examples:

  • Feature flags
  • Connection settings
  • API endpoints
  • Retry counts

Configuration data often differs between environments, while reference data should usually remain identical.


Examples of Reference Data

Country table:

CREATE TABLE dbo.Country
(
CountryCode CHAR(2) PRIMARY KEY,
CountryName NVARCHAR(100)
);

Static data:

INSERT INTO dbo.Country
VALUES
('US','United States'),
('CA','Canada'),
('MX','Mexico');

This script can be committed to Git and deployed automatically.


Why Not Manually Populate Lookup Tables?

Manual updates introduce problems:

  • Human error
  • Missing rows
  • Environment inconsistencies
  • Forgotten updates
  • Difficult auditing

Automated deployment eliminates these risks.


Reference Data in SQL Database Projects

SQL Database Projects primarily manage schema objects.

Reference data is commonly deployed using:

  • Post-deployment scripts
  • SQLCMD scripts
  • Seed scripts
  • Data synchronization scripts

The database schema and required reference data become part of one deployment process.


Post-Deployment Scripts

A post-deployment script runs after the DACPAC deployment completes.

Typical uses include:

  • Insert lookup values
  • Seed tables
  • Create administrative users
  • Initialize configuration

Example:

:r .\SeedData\Countries.sql
:r .\SeedData\OrderStatus.sql
:r .\SeedData\Departments.sql

Each referenced script inserts the required static data.


Organizing Seed Data

A common project structure:

DatabaseProject
├── Tables
├── Views
├── Procedures
├── Security
├── PostDeployment
├── SeedData
│ Countries.sql
│ States.sql
│ PaymentTypes.sql
│ StatusCodes.sql
└── Scripts

Keeping seed data in dedicated folders improves maintainability.


Idempotent Seed Scripts

A deployment may execute multiple times.

Therefore, seed scripts should be idempotent, meaning they can run repeatedly without producing duplicate data.

Instead of:

INSERT INTO Status
VALUES ('Pending');

Use:

IF NOT EXISTS
(
SELECT 1
FROM dbo.Status
WHERE StatusName='Pending'
)
INSERT INTO dbo.Status(StatusName)
VALUES ('Pending');

Running this script multiple times inserts only one row.


Using MERGE for Synchronization

Another common approach is the MERGE statement.

Example:

MERGE dbo.Status AS Target
USING
(
VALUES
('Pending'),
('Shipped'),
('Delivered')
) AS Source(StatusName)
ON Target.StatusName=Source.StatusName
WHEN NOT MATCHED THEN
INSERT(StatusName)
VALUES(Source.StatusName);

MERGE synchronizes reference data without creating duplicates.

Exam Tip: While MERGE is powerful, it has historically had edge cases in SQL Server. Many organizations still use it for static data synchronization, but others prefer separate INSERT, UPDATE, and DELETE statements for greater predictability. Understand both approaches for the exam.


Updating Existing Reference Data

Sometimes lookup values change.

Example:

UPDATE dbo.Country
SET CountryName='United States of America'
WHERE CountryCode='US';

These changes should be committed to source control so all environments receive the update.


Removing Reference Data

Occasionally obsolete values must be removed.

Example:

DELETE
FROM dbo.Status
WHERE StatusName='Obsolete';

Deletion scripts should be carefully reviewed to avoid breaking foreign key relationships.


Versioning Static Data

Reference data evolves over time.

Example:

Version 1

Pending
Shipped
Delivered

Version 2

Pending
Processing
Shipped
Delivered
Cancelled

Git records exactly when each change occurred.


Source Control Workflow

Typical workflow:

Developer updates lookup table
Commit to Git
Pull Request
Code Review
Merge
CI Build
Deploy to Test
Validate
Deploy to Production

This ensures every environment receives the same approved changes.


Reference Data and CI/CD

During deployment:

Build SQL Project
Create DACPAC
Deploy Schema
Run Post-Deployment Scripts
Insert Reference Data
Run Automated Tests
Publish

Reference data becomes part of the deployment pipeline.


Environment Consistency

One major objective of CI/CD is ensuring environments remain synchronized.

For example:

Development

Status
Pending
Processing
Delivered

Testing

Status
Pending
Processing
Delivered

Production

Status
Pending
Processing
Delivered

All environments should contain identical lookup values unless environment-specific configuration is intentionally required.


Reference Data vs. Transactional Data

Reference DataTransactional Data
SmallLarge
Rarely changesConstantly changes
Stored in source controlNot stored in source control
Shared across environmentsEnvironment-specific
Seeded during deploymentGenerated by users

Examples of transactional data include:

  • Orders
  • Customers
  • Invoices
  • Payments
  • Audit logs

Transactional data should not be committed to Git.


Handling Sensitive Data

Reference data should generally not contain:

  • Passwords
  • API keys
  • Secrets
  • Tokens
  • Personally identifiable information (PII)

Secrets should instead be stored in secure solutions such as:

  • Azure Key Vault
  • GitHub Secrets
  • Azure DevOps Library
  • Environment variables

Best Practices

Microsoft recommends:

  • Store lookup data in source control.
  • Keep seed scripts idempotent.
  • Separate schema from reference data.
  • Use post-deployment scripts.
  • Automate deployments.
  • Review reference data changes through pull requests.
  • Avoid manual production updates.
  • Keep environments synchronized.
  • Never store secrets in source control.
  • Test deployment scripts before production.

Common DP-800 Exam Tips

Remember these key points:

TopicKey Point
Reference DataBusiness lookup data that changes infrequently
Transactional DataUser-generated operational data
Source ControlTracks schema and reference data changes
Post-Deployment ScriptCommon method for seeding reference data
Idempotent ScriptSafe to execute multiple times
MERGESynchronizes source and target data
DACPACDeploys schema, not business data by itself
GitStores scripts and deployment history
CI/CDAutomates schema and reference data deployment
SecretsShould be stored outside source control

Summary

Reference (static) data is essential to many database applications and should be managed with the same discipline as database schema. By storing lookup data scripts in source control, developers can ensure consistent deployments across all environments, maintain a complete audit history of changes, and automate data seeding as part of CI/CD pipelines. SQL Database Projects commonly use post-deployment scripts, idempotent SQL, and MERGE statements to deploy and synchronize static data safely. Understanding how reference data differs from transactional and configuration data—and how to manage it securely—is an important objective for the DP-800 certification exam.


Practice Exam Questions

Question 1

A development team wants every deployment to automatically populate the Country lookup table with approved values. What is the recommended approach when using SQL Database Projects?

A. Manually insert the rows after each deployment.

B. Store the data in a post-deployment script under source control.

C. Copy the table directly from the production database.

D. Require application users to populate the table during startup.

Answer: B

Explanation:
Post-deployment scripts are the recommended mechanism for deploying reference data with SQL Database Projects. Keeping these scripts in source control ensures consistency across all environments.


Question 2

Which type of data is most appropriate to store in source control along with a SQL Database Project?

A. Customer orders

B. Audit logs

C. Country codes

D. User transaction history

Answer: C

Explanation:
Country codes are classic reference data that changes infrequently and should be version-controlled. Transactional data such as orders and audit logs should not be stored in source control.


Question 3

Why should reference data deployment scripts be idempotent?

A. To improve query performance.

B. To ensure they can be executed repeatedly without creating duplicate data.

C. To encrypt lookup tables.

D. To automatically generate indexes.

Answer: B

Explanation:
Idempotent scripts produce the same result regardless of how many times they are executed, preventing duplicate rows during repeated deployments.


Question 4

A SQL Database Project deploys successfully, but required lookup values are missing from several tables. Which deployment component was most likely omitted?

A. Database backups

B. Execution plans

C. Post-deployment scripts

D. Statistics updates

Answer: C

Explanation:
DACPAC deployments primarily create schema objects. Reference data is typically inserted through post-deployment scripts.


Question 5

Which statement best describes reference data?

A. It is typically small, shared across environments, and changes infrequently.

B. It changes frequently throughout the day.

C. It consists primarily of user-generated transactional records.

D. It should never be stored in Git.

Answer: A

Explanation:
Reference data is stable business information, such as lookup values, that is commonly deployed to every environment through automated processes.


Question 6

Which SQL statement is commonly used to synchronize source and target reference data during deployment?

A. TRUNCATE

B. ALTER

C. EXECUTE

D. MERGE

Answer: D

Explanation:
MERGE compares source and target data, allowing inserts, updates, and optional deletes within a single statement, making it useful for synchronizing static data.


Question 7

Which item should not typically be stored in source control with reference data scripts?

A. Country lookup values

B. Department codes

C. API keys and passwords

D. Payment status values

Answer: C

Explanation:
Sensitive information such as API keys, passwords, and secrets should be stored securely in services like Azure Key Vault or GitHub Secrets rather than in source control.


Question 8

What is the primary benefit of storing reference data scripts in Git?

A. They provide version history, collaboration, and consistent deployments.

B. They eliminate the need for backups.

C. They reduce database storage requirements.

D. They automatically improve query performance.

Answer: A

Explanation:
Source control provides change tracking, collaboration, auditing, rollback capabilities, and consistent deployments across environments.


Question 9

Which data type would not normally be considered reference data?

A. Order status values

B. Customer invoices

C. Currency codes

D. Sales regions

Answer: B

Explanation:
Customer invoices are transactional records generated during business operations. They should not be managed as static reference data.


Question 10

A development team wants development, testing, and production environments to contain identical lookup values after every deployment. Which DevOps practice best supports this goal?

A. Manually editing lookup tables after deployment.

B. Importing production backups into every environment.

C. Storing reference data scripts in source control and executing them automatically during CI/CD.

D. Allowing each environment to maintain its own independent lookup values.

Answer: C

Explanation:
Automating the deployment of version-controlled reference data ensures that all environments remain synchronized and eliminates manual configuration drift.


Go to the DP-800 Exam Prep Hub main page

Implement auditing – Part 2 (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Implement auditing


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

In Part 1, you learned about the SQL Server Audit architecture, audit specifications, audit targets, audit action groups, and how to configure and manage audits in SQL Server. In this section, we’ll examine how auditing works in Azure SQL services, how audit data integrates with Azure monitoring solutions, and the performance and operational considerations that are especially relevant for the DP-800 exam.


Auditing in Azure SQL Database

Azure SQL Database includes built-in auditing capabilities that are designed for cloud-native environments. Unlike on-premises SQL Server, Azure SQL Database can automatically integrate with Azure services for centralized monitoring and compliance.

Azure SQL auditing records database events such as:

  • Successful and failed logins
  • Database schema changes
  • Permission modifications
  • Data access (SELECT)
  • Data modifications (INSERT, UPDATE, DELETE)
  • Stored procedure execution
  • Security configuration changes
  • Administrative operations

Auditing can be configured at two levels:

  • Server level
  • Individual database level

Server-level auditing provides a consistent policy across all databases on the logical SQL server, while database-level auditing allows different auditing configurations for specific databases.


Azure SQL Auditing Architecture

Azure SQL Database
SQL Auditing
┌──────┼────────┐
▼ ▼ ▼
Storage Log Analytics Event Hub
Account Workspace

One audit configuration can send events to one or more Azure services.


Audit Destinations in Azure

Unlike SQL Server, Azure SQL Database supports several cloud-based audit destinations.

Azure Storage Account

The most common destination.

Benefits include:

  • Low-cost storage
  • Long-term retention
  • Backup
  • Archive capabilities
  • Easy export
  • Compliance support

Organizations frequently retain audit logs in Storage Accounts for multiple years.


Log Analytics Workspace

Many organizations choose Log Analytics because it supports:

  • Interactive searches
  • Kusto Query Language (KQL)
  • Dashboards
  • Alerting
  • Workbooks
  • Azure Monitor integration

Example investigations include:

  • Failed login trends
  • Privileged user activity
  • Permission changes
  • Suspicious DELETE operations

Azure Event Hubs

Event Hubs allows organizations to stream audit events in near real time.

Typical integrations include:

  • SIEM platforms
  • Security monitoring solutions
  • Custom monitoring applications
  • Third-party security tools

Configuring Azure SQL Auditing

Auditing can be enabled through:

  • Azure Portal
  • Azure CLI
  • PowerShell
  • ARM templates
  • Bicep
  • Terraform
  • Azure REST API

Within the Azure Portal, the configuration typically involves:

  1. Select the SQL Server or database.
  2. Open Auditing under the Security section.
  3. Enable auditing.
  4. Choose one or more destinations.
  5. Configure retention settings.
  6. Save the configuration.

Retention Policies

Azure Storage destinations support configurable retention periods.

Examples include:

  • 90 days
  • 180 days
  • 1 year
  • Multiple years

Retention should match organizational compliance requirements.

Examples:

RegulationTypical Retention
PCI DSSAt least one year
HIPAASeveral years (organization-specific)
SOXOften seven years
Internal security policiesVaries

Azure SQL Managed Instance Auditing

Azure SQL Managed Instance supports auditing capabilities similar to SQL Server while integrating with Azure services.

Supported destinations include:

  • Azure Storage
  • Log Analytics
  • Event Hubs

Managed Instance also supports many SQL Server auditing features, making it easier to migrate on-premises workloads to Azure without redesigning security monitoring.


Microsoft Fabric SQL Auditing Considerations

Microsoft Fabric SQL databases and SQL analytics endpoints are integrated into the broader Microsoft Fabric governance ecosystem.

Rather than relying solely on traditional SQL Server Audit objects, Fabric environments also benefit from:

  • Microsoft Purview governance
  • Activity monitoring
  • Workspace monitoring
  • Capacity monitoring
  • Microsoft Fabric Activity Log
  • Azure Monitor integration
  • Microsoft Defender integration

For the DP-800 exam, understand that auditing in Fabric emphasizes cloud-native monitoring and governance rather than traditional SQL Server Audit files.


Viewing Audit Logs

Azure Portal

Administrators can review:

  • Audit status
  • Destination
  • Retention
  • Recent activity

The portal provides quick access to Log Analytics and Storage Accounts where audit records reside.


Log Analytics

Audit records become searchable using Kusto Query Language (KQL).

Example:

AzureDiagnostics
| where Category == "SQLSecurityAuditEvents"
| where statement_s contains "DELETE"

This query returns DELETE statements captured by SQL auditing.


Storage Account

Audit files stored in Azure Storage can be:

  • Downloaded
  • Archived
  • Imported
  • Processed by external tools
  • Loaded into Power BI
  • Queried with Azure Data Explorer

Integrating Auditing with Azure Monitor

Azure Monitor provides centralized monitoring across Azure resources.

Audit logs can generate:

  • Alerts
  • Dashboards
  • Metrics
  • Workbooks
  • Notifications

Example alert:

Notify the security team whenever more than ten failed login attempts occur within five minutes.


Microsoft Sentinel Integration

Microsoft Sentinel is Microsoft’s cloud-native Security Information and Event Management (SIEM) platform.

Audit logs can be streamed into Sentinel where security analysts can:

  • Detect attacks
  • Investigate incidents
  • Correlate events
  • Create analytics rules
  • Build hunting queries
  • Automate responses

Example scenario:

  1. Repeated failed logins
  2. Successful privileged login
  3. Mass DELETE operations

Sentinel correlates these events into a potential security incident.


Microsoft Defender for SQL

Auditing and Microsoft Defender for SQL complement one another.

AuditingDefender for SQL
Records activityDetects threats
Supports complianceUses behavioral analytics
Captures eventsGenerates security alerts
Used during investigationsIdentifies suspicious behavior

For example:

Auditing records that a user executed a large number of DELETE statements, while Defender for SQL may identify that behavior as anomalous and raise a security alert.


Performance Considerations

Auditing introduces some performance overhead because every audited event must be written to an audit target.

The impact depends on factors such as:

  • Number of audited events
  • Frequency of activity
  • Storage performance
  • Audit destination
  • Network latency (Azure)

Fortunately, SQL Server auditing is highly optimized and generally has minimal impact when configured appropriately.


Reducing Performance Overhead

Microsoft recommends several strategies.

Audit Only Necessary Events

Avoid auditing every possible action.

Instead, focus on:

  • Logins
  • Permission changes
  • Sensitive table access
  • Administrative operations

Avoid Excessive SELECT Auditing

High-volume transactional systems may execute millions of SELECT statements daily.

Auditing every SELECT can:

  • Increase storage consumption
  • Generate enormous audit files
  • Reduce performance

Instead, audit only access to sensitive tables.


Separate Audit Storage

Whenever possible:

  • Store audit files on separate disks.
  • Use dedicated Azure Storage Accounts.
  • Avoid sharing storage with transaction logs.

Archive Older Logs

Large audit repositories become difficult to search.

Implement:

  • Automatic archiving
  • Lifecycle management
  • Long-term storage
  • Periodic cleanup

Monitoring Audit Health

Administrators should routinely verify that auditing is functioning correctly.

Check:

  • Audit status
  • Storage availability
  • Remaining storage capacity
  • Failed audit writes
  • Log Analytics ingestion
  • Event Hub connectivity
  • Audit retention settings

Monitoring helps prevent gaps in audit coverage.


Common Auditing Scenarios

Scenario 1

A hospital must record every update to patient records.

Recommended approach:

  • Database auditing
  • Audit UPDATE operations
  • Store logs in Azure Storage
  • Retain logs according to healthcare regulations

Scenario 2

A bank wants immediate notification when administrators change permissions.

Recommended approach:

  • Audit permission changes
  • Send events to Log Analytics
  • Create Azure Monitor alerts
  • Forward alerts to Microsoft Sentinel

Scenario 3

A company wants to investigate suspicious DELETE statements after a potential insider attack.

Recommended approach:

  • Query audit logs
  • Identify user accounts
  • Review timestamps
  • Correlate activity with authentication logs

Common Mistakes

Candidates often confuse several related security technologies.

FeaturePurpose
AuditingRecords activity
Dynamic Data MaskingHides data
Row-Level SecurityFilters rows
Always EncryptedEncrypts data
Transparent Data EncryptionEncrypts database files
Microsoft Defender for SQLDetects threats

Remember:

  • Auditing records activity.
  • It does not prevent activity.
  • It does not encrypt data.
  • It does not mask data.

DP-800 Exam Tips

Expect scenario-based questions such as:

  • Which audit destination should be selected?
  • Which service enables security investigations?
  • Which Azure service should receive audit logs?
  • How should audits be configured for compliance?
  • Which audit events should be enabled?
  • How can auditing be integrated with Azure Monitor?

Also remember:

  • Azure Storage is commonly used for long-term retention.
  • Log Analytics is best for querying and analysis.
  • Event Hubs is designed for real-time event streaming.
  • Microsoft Sentinel builds on audit logs to provide advanced threat detection and incident response.
  • Microsoft Defender for SQL complements auditing by detecting suspicious behavior rather than simply recording it.

Best Practices Summary

  • Enable auditing for all production databases.
  • Audit only security-relevant events to minimize overhead.
  • Prefer centralized monitoring using Azure Monitor and Log Analytics.
  • Protect audit logs from unauthorized modification or deletion.
  • Configure retention policies that satisfy organizational and regulatory requirements.
  • Integrate auditing with Microsoft Sentinel for security operations.
  • Periodically review audit logs and validate that auditing remains enabled after deployments or configuration changes.
  • Document audit policies and test recovery procedures for audit data.

Go to the DP-800 Exam Prep Hub main page

Design and implement Dynamic Data Masking (DDM) (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Design and implement Dynamic Data Masking


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

What is Dynamic Data Masking?

Dynamic Data Masking (DDM) is a SQL Server and Azure SQL feature that limits the exposure of sensitive data by masking the results returned to non-privileged users without modifying the actual data stored in the database.

Unlike encryption, DDM does not change or encrypt the stored data. Instead, SQL Server dynamically replaces sensitive values with masked values when queries are executed by users who do not have permission to view the original data.

For example, the database may contain:

CustomerNameSSNEmail
John Smith123-45-6789john@email.com

A privileged user sees:

CustomerNameSSNEmail
John Smith123-45-6789john@email.com

A non-privileged user may see:

CustomerNameSSNEmail
John SmithXXX-XX-6789jXXX@XXXX.com

The underlying data never changes.


Why Use Dynamic Data Masking?

Organizations frequently store sensitive information such as:

  • Personally Identifiable Information (PII)
  • Social Security Numbers
  • Credit card numbers
  • Email addresses
  • Phone numbers
  • Employee salaries
  • Medical information

Not every user who queries the database should have unrestricted access to these values.

DDM allows developers to:

  • Reduce accidental data exposure
  • Protect sensitive fields
  • Simplify application development
  • Support compliance initiatives
  • Allow customer support personnel to work with realistic-looking data

How Dynamic Data Masking Works

When a user executes a query:

  1. SQL Server checks whether the user has permission to view unmasked data.
  2. If the user has the UNMASK permission, actual values are returned.
  3. Otherwise, SQL Server substitutes masked values before sending the results.

The database itself remains unchanged.


Dynamic Data Masking Architecture

Database
├── Actual Data
│ 987-65-4321
├── User A
│ Has UNMASK permission
│ Result:
│ 987-65-4321
└── User B
No UNMASK permission
Result:
XXX-XX-4321

Benefits of Dynamic Data Masking

DDM provides several important advantages.

Easy to Implement

Masking is configured using T-SQL without requiring application changes.


No Data Duplication

The original data remains stored only once.


Transparent to Applications

Applications continue issuing the same queries.

No application code changes are required.


Supports Least Privilege

Users receive only the information they need.


Helps Meet Compliance Requirements

Although DDM is not encryption, it helps organizations reduce unnecessary exposure of sensitive information.


Dynamic Data Masking vs Encryption

Dynamic Data MaskingEncryption
Masks query resultsEncrypts stored data
Data remains unchangedData stored encrypted
Protects against accidental viewingProtects against data theft
Transparent to applicationsMay require encryption keys
Does not secure backupsProtects stored data

Microsoft expects candidates to understand that DDM is not a replacement for encryption technologies such as Always Encrypted or Transparent Data Encryption (TDE).


Supported Masking Functions

SQL Server supports several built-in masking functions.


Default Mask

Masks data according to its data type.

Example:

Original:

John Smith

Masked:

XXXX

Syntax:

MASKED WITH (FUNCTION = 'default()')

Email Mask

Designed specifically for email addresses.

Original:

john.smith@email.com

Masked:

jXXX@XXXX.com

Syntax:

MASKED WITH (FUNCTION = 'email()')

Partial Mask

Reveals part of a string while masking the remainder.

Example:

Original:

555-123-4567

Masked:

XXX-XXX-4567

Syntax:

MASKED WITH
(
FUNCTION='partial(prefix,padding,suffix)'
)

Example:

MASKED WITH
(
FUNCTION='partial(0,"XXX-XXX-",4)'
)

Random Mask

Returns a random value within a specified numeric range.

Example:

Original Salary

85000

Masked

43782

Syntax

MASKED WITH
(
FUNCTION='random(1,100000)'
)

Useful when exact values should never be exposed.


Creating a Masked Column

Example:

CREATE TABLE Customers
(
CustomerID INT,
Name NVARCHAR(100),
Email NVARCHAR(200)
MASKED WITH (FUNCTION='email()'),
SSN CHAR(11)
MASKED WITH
(
FUNCTION='partial(0,"XXX-XX-",4)'
)
);

Adding a Mask to an Existing Column

ALTER TABLE Customers
ALTER COLUMN Email
ADD MASKED
WITH (FUNCTION='email()');

Removing a Mask

ALTER TABLE Customers
ALTER COLUMN Email
DROP MASKED;

Granting UNMASK Permission

Privileged users may view actual values.

GRANT UNMASK TO HRManager;

Revoking Permission

REVOKE UNMASK FROM HRManager;

Viewing Mask Definitions

View masking metadata.

SELECT *
FROM sys.masked_columns;

Useful during administration and auditing.


DDM with Azure SQL Database

Dynamic Data Masking is fully supported in:

  • Azure SQL Database
  • Azure SQL Managed Instance
  • SQL Server

Azure SQL also provides portal-based configuration through the Azure Portal.

Developers can create masks without writing T-SQL.


Limitations of Dynamic Data Masking

Candidates should understand these limitations.

It Is Not Encryption

Anyone with sufficient permissions can retrieve actual values.


Database Administrators Can View Data

Members of powerful administrative roles can bypass masking.


Cannot Stop Inference Attacks

Users may infer values through repeated queries.


Not Intended for High-Security Scenarios

Highly confidential data should use:

  • Always Encrypted
  • Transparent Data Encryption
  • Row-Level Security
  • Proper access control

Expressions Return Masked Values

If a masked column is used in expressions, the expression also returns masked results for users without UNMASK permission.


Best Practices

Mask Only Sensitive Columns

Avoid unnecessary masking.


Combine with Other Security Features

Use together with:

  • Always Encrypted
  • Row-Level Security
  • Transparent Data Encryption
  • Microsoft Entra authentication
  • Least privilege access

Grant UNMASK Sparingly

Only trusted users should receive this permission.


Test Using Non-Privileged Accounts

Always verify what ordinary users actually see.


Audit Sensitive Access

Monitor who receives UNMASK permissions.


Dynamic Data Masking vs Row-Level Security

Dynamic Data MaskingRow-Level Security
Masks valuesFilters rows
User sees all rowsUser sees only authorized rows
Protects columnsProtects records
Works with SELECT resultsControls data visibility
Often used with RLSOften combined with DDM

DP-800 Exam Tips

Candidates should be able to:

  • Explain what Dynamic Data Masking is.
  • Differentiate masking from encryption.
  • Identify supported masking functions.
  • Create masked columns using CREATE TABLE and ALTER TABLE.
  • Grant and revoke the UNMASK permission.
  • Understand when DDM is appropriate.
  • Recognize DDM limitations.
  • Choose DDM versus Always Encrypted, TDE, or Row-Level Security based on the security requirement.
  • Understand that DDM protects against accidental exposure, not malicious users with elevated privileges.

Practice Exam Questions

Question 1

A company wants customer support representatives to view only partially masked Social Security numbers while allowing HR staff to view the full values.

Which SQL Server feature best meets this requirement?

A. Transparent Data Encryption

B. Dynamic Data Masking

C. Always Encrypted

D. Data Compression

Answer: B

Explanation: Dynamic Data Masking displays masked values to unauthorized users while allowing authorized users with the appropriate permissions to see the original data.


Question 2

Which statement about Dynamic Data Masking is true?

A. It encrypts data stored on disk.

B. It permanently changes stored values.

C. It masks query results for users without UNMASK permission.

D. It replaces encryption.

Answer: C

Explanation: Dynamic Data Masking only alters the data presented in query results. The stored values remain unchanged.


Question 3

Which masking function is specifically designed for email addresses?

A. partial()

B. random()

C. default()

D. email()

Answer: D

Explanation: The email() masking function preserves the general format of an email address while obscuring most of the information.


Question 4

Which statement best describes the partial() masking function?

A. It encrypts selected characters.

B. It returns random values.

C. It permanently replaces data.

D. It reveals specified prefix and suffix characters while masking the middle.

Answer: D

Explanation: The partial() function exposes configurable leading and trailing characters while masking the remaining portion of the value.


Question 5

Which permission allows a user to view unmasked data?

A. SELECT

B. CONTROL

C. UNMASK

D. VIEW DEFINITION

Answer: C

Explanation: Users granted the UNMASK permission can view the original values instead of the masked representations.


Question 6

Which system catalog view displays information about masked columns?

A. sys.columns

B. sys.masked_columns

C. sys.tables

D. sys.database_permissions

Answer: B

Explanation: The sys.masked_columns catalog view contains metadata about all columns configured with Dynamic Data Masking.


Question 7

A database administrator wants to protect highly confidential financial information from administrators who manage the database server.

Which technology should be preferred over Dynamic Data Masking?

A. Always Encrypted

B. Dynamic Data Masking

C. Partial masking

D. Random masking

Answer: A

Explanation: Always Encrypted ensures that sensitive data remains encrypted even from database administrators because encryption and decryption occur on the client side.


Question 8

Which statement about Dynamic Data Masking and application code is generally correct?

A. Applications must always be rewritten.

B. DDM requires client-side decryption.

C. Existing queries usually continue to work without modification.

D. Applications cannot access masked tables.

Answer: C

Explanation: Dynamic Data Masking is transparent to most applications, allowing existing queries to function normally while returning masked data when appropriate.


Question 9

A developer executes the following statement:

GRANT UNMASK TO SalesManager;

What is the effect?

A. The SalesManager can modify masked columns.

B. The SalesManager can bypass row-level security.

C. The SalesManager can view original values in masked columns, provided they also have permission to access the data.

D. All users inherit the UNMASK permission.

Answer: C

Explanation: The UNMASK permission allows a user to see unmasked values but does not grant access to data that the user is otherwise unauthorized to read.


Question 10

Which security strategy provides the strongest protection for sensitive database columns?

A. Use only Dynamic Data Masking.

B. Use only Row-Level Security.

C. Use only Transparent Data Encryption.

D. Combine Dynamic Data Masking with encryption, least-privilege access, and other SQL Server security features.

Answer: D

Explanation: Dynamic Data Masking is most effective as part of a layered security strategy that also includes encryption, access controls, auditing, and other SQL Server security features.


Go to the DP-800 Exam Prep Hub main page

Run a data access governance report in SharePoint (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify and monitor oversharing in SharePoint in Microsoft 365
      --> Run a data access governance report in SharePoint


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

That is an excellent next topic for the AB-900 exam because it combines SharePoint governance, Microsoft Purview, and Copilot data security. Although the feature continues to evolve, the exam focuses on understanding what the report is, when to use it, and what problems it helps administrators solve, rather than memorizing every UI step.


Why Data Access Governance Matters

One of the largest security challenges in Microsoft 365 is oversharing. Over time, organizations accumulate millions of files, thousands of SharePoint sites, and numerous Microsoft Teams workspaces. Permissions often become increasingly complex as users:

  • Share files externally
  • Create anonymous sharing links
  • Grant access to “Everyone”
  • Add guests to Teams
  • Break inheritance on folders
  • Forget to remove temporary permissions

As organizations adopt Microsoft 365 Copilot, overshared content becomes an even greater concern because Copilot can surface information that a user already has permission to access—even if that access was unintentionally granted.

Microsoft provides Data Access Governance (DAG) capabilities in SharePoint to help administrators discover, understand, and remediate excessive access before it becomes a security issue.


What is Data Access Governance?

Data Access Governance is a collection of reporting and analysis capabilities within SharePoint Advanced Management that helps administrators answer questions such as:

  • Which sites are accessible by everyone?
  • Which files are overshared?
  • Which sites have external users?
  • Which sites contain highly sensitive information?
  • Which permissions may expose confidential content?
  • Which sites should be reviewed?

Rather than examining permissions one site at a time, administrators receive organization-wide visibility.


Primary Goals of Data Access Governance

Data Access Governance helps organizations:

  • Discover overshared sites
  • Review permissions
  • Reduce excessive access
  • Identify high-risk collaboration
  • Improve Microsoft 365 security posture
  • Prepare for Microsoft 365 Copilot deployment
  • Reduce accidental data exposure
  • Support compliance initiatives

Why It Is Important for Microsoft 365 Copilot

Microsoft 365 Copilot never ignores permissions.

Instead, it retrieves content using the same security model that governs Microsoft 365.

If a user has permission to open a document manually, Copilot can potentially reference that document when generating responses.

For example:

Suppose Human Resources accidentally grants the entire company read access to salary spreadsheets.

Without Copilot:

  • Most employees may never discover the files.

With Copilot:

A user might ask:

“Summarize employee compensation data.”

Because the files are already accessible, Copilot could retrieve them.

The problem is not Copilot—it is the underlying permissions.

Data Access Governance helps identify these permission problems before they become security risks.


What the Data Access Governance Report Shows

The report provides administrators with visibility into SharePoint permissions and sharing configurations across the tenant.

Common information includes:

  • Site owners
  • Site sensitivity
  • External sharing status
  • Number of members
  • Anonymous links
  • Organization-wide access
  • Guest access
  • Sharing activity
  • Permission inheritance
  • Access patterns
  • High-risk sites
  • Overshared content indicators

Rather than searching manually, administrators can prioritize the highest-risk locations.


Types of Oversharing That Can Be Identified

The report can identify situations such as:

Organization-wide access

Sites accessible by:

  • Everyone
  • Everyone except external users
  • Large security groups

These sites often expose more content than intended.


Anonymous Links

Files shared through links that require no authentication.

These links may remain active long after they are needed.


Guest Access

Sites containing:

  • External users
  • Partner accounts
  • Vendor accounts

Administrators can verify whether guest access is still appropriate.


Excessive Sharing

Examples include:

  • Large numbers of shared files
  • Broad sharing permissions
  • Public document libraries
  • Open collaboration spaces

Sensitive Sites

The report can identify sites that contain:

  • Financial information
  • HR records
  • Legal documents
  • Intellectual property
  • Customer information

Combined with Microsoft Purview sensitivity labels, administrators gain better visibility into where important information resides.


Typical Workflow

Administrators generally follow this process:

Step 1

Open SharePoint administration tools.


Step 2

Generate or review a Data Access Governance report.


Step 3

Review identified risks.

Examples:

  • Overshared sites
  • External sharing
  • Everyone permissions
  • Sensitive content

Step 4

Investigate high-risk sites.

Questions include:

  • Does this access need to exist?
  • Are guests still required?
  • Is inheritance broken?
  • Should permissions be reduced?

Step 5

Take corrective action.

Possible actions include:

  • Remove permissions
  • Restrict sharing
  • Apply sensitivity labels
  • Disable anonymous links
  • Reduce guest access
  • Educate site owners

Step 6

Run reports regularly to verify improvements.


Relationship with Microsoft Purview

Data Access Governance works alongside Microsoft Purview.

Purview answers questions such as:

  • What sensitive data exists?
  • How is it classified?
  • Which labels are applied?
  • Are DLP policies triggered?

SharePoint Data Access Governance answers:

  • Who can access the data?
  • Is the data overshared?
  • Which sites expose information?
  • Which permissions should be reviewed?

Together they provide both:

  • Content awareness
  • Permission awareness

Relationship with Microsoft 365 Copilot

Data Access Governance helps administrators prepare for Copilot by reducing permission-related risks.

Benefits include:

  • Finding overshared SharePoint sites
  • Identifying unnecessary permissions
  • Reducing broad access
  • Reviewing guest sharing
  • Protecting confidential information
  • Improving search security
  • Supporting Zero Trust principles

Best Practices

Microsoft recommends that organizations:

  • Review sharing reports regularly.
  • Audit external access periodically.
  • Minimize “Everyone” permissions.
  • Remove unused guest accounts.
  • Apply sensitivity labels to important sites.
  • Use Microsoft Purview DLP alongside SharePoint governance.
  • Educate site owners on responsible sharing.
  • Review high-risk collaboration sites before deploying Copilot broadly.
  • Follow the principle of least privilege.
  • Continuously monitor permission changes.

Common Exam Tips

Remember these key points:

  • Data Access Governance focuses on permissions and access, not document content.
  • It helps identify oversharing across SharePoint.
  • It is especially valuable before deploying Microsoft 365 Copilot.
  • Copilot respects existing Microsoft 365 permissions.
  • Oversharing is a permissions problem, not a Copilot problem.
  • Reports help administrators prioritize high-risk sites for remediation.
  • Data Access Governance complements Microsoft Purview rather than replacing it.

Practice Exam Questions

Question 1

Why would an administrator run a Data Access Governance report in SharePoint?

A. To update SharePoint servers

B. To identify overshared sites and permission risks

C. To encrypt all documents automatically

D. To generate Microsoft 365 licenses

Correct Answer: B

Explanation: Data Access Governance helps administrators identify sites with excessive permissions, external sharing, and other access-related risks.


Question 2

Which issue is Data Access Governance primarily designed to identify?

A. SQL database corruption

B. Printer failures

C. Oversharing of SharePoint content

D. Network latency

Correct Answer: C

Explanation: The primary purpose is to detect oversharing and excessive permissions across SharePoint.


Question 3

Why is Data Access Governance especially important before deploying Microsoft 365 Copilot?

A. Copilot automatically changes permissions.

B. Copilot ignores SharePoint security.

C. Copilot copies all SharePoint files.

D. Copilot can reference content users already have permission to access.

Correct Answer: D

Explanation: Copilot honors existing permissions. Overshared content may therefore appear in Copilot responses if users already have legitimate access.


Question 4

Which type of access represents a potential oversharing risk?

A. Anonymous sharing links

B. Azure subscription ownership

C. Exchange mailbox size

D. Microsoft Teams background images

Correct Answer: A

Explanation: Anonymous links allow access without authentication and should be reviewed carefully.


Question 5

What question does Data Access Governance primarily help answer?

A. Which users have excessive access to SharePoint content?

B. Which Windows updates are missing?

C. Which devices need antivirus software?

D. Which Microsoft 365 licenses should be purchased?

Correct Answer: A

Explanation: Data Access Governance focuses on permissions, sharing, and access to SharePoint content.


Question 6

Which Microsoft 365 principle is supported by regularly reviewing Data Access Governance reports?

A. Unlimited collaboration

B. Least privilege

C. Maximum storage allocation

D. Unlimited guest access

Correct Answer: B

Explanation: Regular reviews help ensure users have only the permissions necessary to perform their work.


Question 7

Which type of SharePoint site would likely appear as higher risk in a Data Access Governance report?

A. A private HR site with restricted access

B. A site shared with only one administrator

C. A site containing sensitive files that is accessible to everyone

D. A newly created empty site

Correct Answer: C

Explanation: Sensitive information combined with broad permissions represents a significant oversharing risk.


Question 8

How does Data Access Governance complement Microsoft Purview?

A. Both products only classify documents.

B. Data Access Governance focuses on permissions, while Purview focuses on data protection and governance.

C. They perform identical functions.

D. Purview replaces SharePoint permissions.

Correct Answer: B

Explanation: Purview governs and protects data, while Data Access Governance helps administrators understand who has access to that data.


Question 9

Which action should an administrator consider after identifying an overshared SharePoint site?

A. Delete all documents immediately.

B. Disable Microsoft 365 Copilot.

C. Purchase additional SharePoint storage.

D. Review and reduce unnecessary permissions.

Correct Answer: D

Explanation: The appropriate response is to evaluate existing permissions and remove excessive or unnecessary access while maintaining business needs.


Question 10

Which statement about Microsoft 365 Copilot and Data Access Governance is true?

A. Data Access Governance prevents all Copilot responses.

B. Copilot bypasses SharePoint permissions when generating answers.

C. Data Access Governance helps reduce the risk of Copilot surfacing overshared information by identifying excessive permissions.

D. Copilot encrypts all SharePoint documents before using them.

Correct Answer: C

Explanation: By identifying and remediating overshared permissions, Data Access Governance helps ensure Copilot only surfaces information that users are appropriately authorized to access.


Go to the AB-900 Exam Prep Hub main page

Common Data Mistakes Businesses Make (and How to Fix Them)

Most organizations don’t fail at data because they lack tools or technology. They fail, or have sub-optimal data outcomes, because of small, repeated mistakes that quietly undermine trust, decision-making, and value. The good news is that these mistakes are fixable.

Here we outline a few of the common mistakes and how to fix them.


Treating Data as an Afterthought

The mistake:
Data is considered only after systems are built, processes are defined, or decisions are already made. Analytics becomes reactive instead of intentional.

How to fix it:
Bring data thinking into the earliest stages of planning. Define what success looks like, what needs to be measured, and how data will be captured before solutions go live.


Measuring Everything Instead of What Matters

The mistake:
Dashboards become crowded with metrics that look interesting but don’t influence decisions. Teams spend more time reporting than acting.

How to fix it:
Identify a small set of actionable metrics and KPIs aligned to business goals. If a metric doesn’t inform a decision or behavior, question why it exists.


Confusing Metrics with KPIs

The mistake:
Operational metrics are treated as strategic indicators, or KPIs are defined without clear ownership or accountability.

How to fix it:
Clearly distinguish between metrics and KPIs. Assign owners to each KPI and ensure they are reviewed regularly with a focus on decisions and outcomes.


Poor or Inconsistent Definitions

The mistake:
Different teams use the same terms—such as “customer,” “active user,” or “revenue”—but mean different things. This leads to conflicting numbers and erodes trust.

How to fix it:
Create and maintain shared definitions through a business glossary or semantic layer. Make definitions visible and easy to reference, not hidden in documentation no one reads.


Ignoring Data Quality Until It’s a Crisis

The mistake:
Data quality issues are only addressed after reports are wrong, decisions are challenged, or leadership loses confidence.

How to fix it:
Treat data quality as an ongoing discipline. Monitor freshness, completeness, accuracy, and consistency. Build checks into pipelines and surface issues early.


Relying Too Much on Manual Processes

The mistake:
Critical reports depend on spreadsheets, manual data pulls, or individual expertise. This creates risk, delays, and scalability issues.

How to fix it:
Automate data pipelines and reporting wherever possible. Reduce dependency on individuals and create repeatable, documented processes.


Focusing on Tools Instead of Understanding

The mistake:
Organizations invest heavily in BI tools, data platforms, or AI features but don’t invest equally in data literacy.

How to fix it:
Train users to understand data, ask better questions, and interpret results correctly. The value of data comes from people, not platforms.


Lacking Clear Ownership and Governance

The mistake:
No one is accountable for data domains, leading to duplication, inconsistency, and confusion.

How to fix it:
Define clear ownership for data domains, datasets, and KPIs. Lightweight governance—focused on clarity and accountability—often works better than rigid controls.


Using Historical Data Only

The mistake:
Decisions are based solely on past performance, with little attention to leading indicators or real-time signals.

How to fix it:
Complement historical reporting with forward-looking and operational metrics. Trends, early signals, and predictive indicators enable proactive decision-making.


Losing Sight of the Business Question

The mistake:
Teams focus on building reports and models without a clear understanding of the business problem they’re trying to solve.

How to fix it:
Start every data initiative with a simple question: What decision will this support? Let the question drive the data—not the other way around.


In Summary

Most data problems aren’t technical—they’re organizational, cultural, or conceptual. Businesses that succeed with data focus less on collecting more information and more on creating clarity, trust, and action.

Strong data practices don’t just produce insights. They enable better decisions, faster responses, and sustained business value.

Thanks for reading and good luck on your data journey!

Glossary – 100 “Data Governance” Terms

Below is a glossary that includes 100 “Data Governance” terms and phrases, along with their definitions and examples, in alphabetical order. Enjoy!

TermDefinition & Example
Access ControlRestricting data access. Example: Role-based permissions.
Audit TrailRecord of data access and changes. Example: Who updated records.
Business GlossaryStandardized business terms. Example: Definition of “Revenue”.
Business MetadataBusiness context of data. Example: KPI definitions.
Change ManagementManaging governance adoption. Example: New policy rollout.
Compliance AuditFormal governance assessment. Example: External audit.
Consent ManagementTracking user permissions. Example: Marketing opt-ins.
ControlMechanism to reduce risk. Example: Access approval workflows.
Control FrameworkStructured control set. Example: SOX controls.
Data AccountabilityClear responsibility for data outcomes. Example: Named data owners.
Data Accountability ModelFramework assigning responsibility. Example: Owner–steward mapping.
Data AccuracyCorrectness of data values. Example: Valid email addresses.
Data ArchivingMoving inactive data to long-term storage. Example: Historical logs.
Data BreachUnauthorized data exposure. Example: Leaked customer records.
Data CatalogCentralized inventory of data assets. Example: Enterprise data catalog tool.
Data CertificationMarking trusted datasets. Example: “Certified” badge.
Data ClassificationCategorizing data by sensitivity. Example: Public vs confidential.
Data CompletenessPresence of required data. Example: No missing customer IDs.
Data ComplianceAdherence to internal policies. Example: Quarterly audits.
Data ConsistencyUniform data representation. Example: Same currency everywhere.
Data ContractAgreement on data structure and SLAs. Example: Producer-consumer contract.
Data CustodianTechnical role managing data infrastructure. Example: Database administrator.
Data DictionaryRepository of field definitions. Example: Column descriptions.
Data DisposalSecure deletion of data. Example: End-of-life purging.
Data DomainLogical grouping of data. Example: Finance data domain.
Data EthicsResponsible use of data. Example: Avoiding discriminatory models.
Data GovernanceFramework of policies, roles, and processes for managing data. Example: Enterprise data governance program.
Data Governance CharterFormal governance mandate. Example: Executive-approved charter.
Data Governance CouncilOversight group for governance decisions. Example: Cross-functional committee.
Data Governance MaturityLevel of governance capability. Example: Ad hoc vs optimized.
Data Governance PlatformIntegrated governance tooling. Example: Enterprise governance suite.
Data Governance RoadmapPlanned governance initiatives. Example: 3-year roadmap.
Data HarmonizationAligning data definitions. Example: Unified metrics.
Data IntegrationCombining data from multiple sources. Example: CRM + ERP merge.
Data IntegrityTrustworthiness across lifecycle. Example: Referential integrity.
Data Issue ManagementTracking and resolving data issues. Example: Data quality tickets.
Data LifecycleStages from creation to disposal. Example: Create → archive → delete.
Data LineageTracking data from source to consumption. Example: Source → dashboard mapping.
Data LiteracyAbility to understand and use data. Example: Training programs.
Data MaskingObscuring sensitive data. Example: Masked credit card numbers.
Data MeshDomain-oriented governance approach. Example: Decentralized ownership.
Data MonitoringContinuous oversight of data. Example: Schema change alerts.
Data ObservabilityMonitoring data health. Example: Freshness alerts.
Data OwnerAccountable role for a dataset. Example: VP of Sales owns sales data.
Data Ownership MatrixMapping data to owners. Example: RACI chart.
Data Ownership ModelAssignment of accountability. Example: Business-owned data.
Data Ownership TransferChanging ownership responsibility. Example: Org restructuring.
Data PolicyHigh-level rules for data handling. Example: Data retention policy.
Data PrivacyProper handling of personal data. Example: GDPR compliance.
Data ProductGoverned, consumable dataset. Example: Curated sales table.
Data ProfilingAssessing data characteristics. Example: Null percentage analysis.
Data QualityAccuracy, completeness, and reliability of data. Example: No duplicate customer IDs.
Data Quality RuleCondition data must meet. Example: Order date cannot be null.
Data RetentionRules for how long data is kept. Example: 7-year retention policy.
Data Review ProcessPeriodic governance review. Example: Policy refresh.
Data RiskPotential harm from data misuse. Example: Regulatory fines.
Data SecuritySafeguarding data from unauthorized access. Example: Encryption at rest.
Data Sharing AgreementRules for sharing data. Example: Partner data exchange.
Data StandardAgreed-upon data definition or format. Example: ISO country codes.
Data StewardshipOperational responsibility for data quality and usage. Example: Business steward for customer data.
Data TimelinessData availability when needed. Example: Daily refresh SLA.
Data TraceabilityAbility to trace data changes. Example: Transformation history.
Data TransparencyVisibility into data usage and meaning. Example: Open definitions.
Data TrustConfidence in data reliability. Example: Executive reporting.
Data Usage PolicyRules for data consumption. Example: Analytics-only usage.
Data ValidationChecking data against rules. Example: Type and range checks.
EncryptionEncoding data for protection. Example: AES encryption.
Enterprise Data GovernanceOrganization-wide governance approach. Example: Company-wide standards.
Exception ManagementHandling rule violations. Example: Approved data overrides.
Federated GovernanceShared governance model. Example: Domain-level ownership.
Golden RecordSingle trusted version of an entity. Example: Unified customer profile.
Governance FrameworkStructured governance approach. Example: DAMA-DMBOK.
Governance MetricsMeasurements of governance success. Example: Issue resolution time.
Impact AnalysisAssessing effects of data changes. Example: Column removal impact.
Incident ResponseHandling data security incidents. Example: Breach mitigation plan.
KPI (Governance KPI)Metric for governance effectiveness. Example: Data quality score.
Least PrivilegeMinimum access needed principle. Example: Read-only analyst access.
Master DataCore business entities. Example: Customers, products.
MetadataInformation describing data. Example: Column definitions.
Metadata ManagementManaging metadata lifecycle. Example: Automated harvesting.
Operating ControlsDay-to-day governance controls. Example: Access reviews.
Operating ModelHow governance roles interact. Example: Centralized governance.
Operational MetadataData about data processing. Example: Load timestamps.
Personally Identifiable Information (PII)Data identifying individuals. Example: Social Security number.
Policy EnforcementEnsuring policies are followed. Example: Automated checks.
Policy ExceptionApproved deviation from policy. Example: Temporary access grant.
Policy LifecycleCreation, approval, review of policies. Example: Annual updates.
Protected Health Information (PHI)Health-related personal data. Example: Medical records.
Reference ArchitectureStandard governance architecture. Example: Approved tooling stack.
Reference DataControlled value sets. Example: Country lists.
Regulatory ComplianceMeeting legal data requirements. Example: GDPR, CCPA.
Risk AssessmentEvaluating governance risks. Example: Privacy risk scoring.
Risk ManagementIdentifying and mitigating data risks. Example: Privacy risk assessment.
Sensitive DataData requiring protection. Example: Financial records.
SLA (Service Level Agreement)Data delivery expectations. Example: Refresh by 8 AM.
Stakeholder EngagementInvolving business users. Example: Governance workshops.
Stewardship ModelStructure of stewardship roles. Example: Business and technical stewards.
Technical MetadataSystem-level data information. Example: Data types and schemas.
TokenizationReplacing sensitive data with tokens. Example: Payment systems.
Tooling EcosystemSet of governance tools. Example: Catalog + lineage tools.

Promote or certify Power BI content (PL-300 Exam Prep)

This post is a part of the PL-300: Microsoft Power BI Data Analyst Exam Prep Hub; and this topic falls under these sections:
Manage and secure Power BI (15–20%)
--> Create and manage workspaces and assets
--> Promote or certify Power BI content


Note that there are 10 practice questions (with answers and explanations) at the end of each topic. Also, there are 2 practice tests with 60 questions each available on the hub below all the exam topics.

Overview

In Power BI, promoting and certifying content helps organizations establish trust, data governance, and self-service analytics at scale. These features allow users to quickly identify which datasets, reports, and dataflows are approved for reuse and suitable for decision-making.

For the PL-300 exam, you must understand:

  • The difference between promoted and certified content
  • Who can promote or certify content
  • Which Power BI artifacts support these labels
  • How promotion and certification impact discovery, reuse, and governance

What Does It Mean to Promote Content?

Promoted content indicates that an item is recommended for use, but it has not gone through a formal certification process.

Key Characteristics of Promoted Content

  • Signals good quality and usefulness
  • Often created by experienced report authors or teams
  • Does not require tenant-level approval
  • Can be promoted by:
    • Dataset owners
    • Workspace members (depending on permissions)

Supported Artifacts

  • Datasets (semantic models)
  • Dataflows
  • Reports

Common Use Cases

  • Department-level datasets
  • Team-managed reports
  • Content that is reliable but still evolving

What Does It Mean to Certify Content?

Certified content represents the highest level of trust in Power BI. It indicates that the content has been reviewed, approved, and governed according to organizational standards.

Key Characteristics of Certified Content

  • Approved by authorized reviewers
  • Requires Power BI tenant admin configuration
  • Used as a single source of truth
  • Clearly marked with a Certified badge

Who Can Certify Content?

  • Users assigned as certifiers by a Power BI tenant administrator
  • Typically part of:
    • IT
    • Data governance
    • Center of Excellence (CoE)

Supported Artifacts

  • Datasets (semantic models)
  • Dataflows

Important for the exam:
Reports cannot be certified directly — certification applies to the underlying dataset or dataflow.


Promote vs. Certify: Key Differences

FeaturePromotedCertified
Approval requiredNoYes
Tenant admin involvementNoYes
Trust levelMediumHigh
Intended audienceTeam or departmentOrganization-wide
Governance reviewInformalFormal
Exam relevanceMediumHigh

How Promotion and Certification Affect Users

When users browse content in Power BI:

  • Certified items appear first in searches
  • Users are encouraged to build new reports using certified datasets
  • Reduces duplication of datasets and metrics
  • Improves consistency across reports and dashboards

This directly supports self-service analytics with governance, a recurring PL-300 theme.


Where Promotion and Certification Are Configured

Promotion and certification are managed in:

  • Power BI Service
  • Dataset or dataflow Settings
  • Workspace context (not Power BI Desktop)

Tenant admins control:

  • Whether certification is enabled
  • Who can certify content

Exam Scenarios to Watch For

On the PL-300 exam, expect scenarios like:

  • Choosing between promoted vs. certified content
  • Identifying who can certify a dataset
  • Determining why a report cannot be certified
  • Understanding how certification affects dataset reuse

Best Practices (Exam-Relevant)

  • Promote content that is reliable but not formally governed
  • Certify content that is:
    • Widely used
    • Business-critical
    • Carefully validated
  • Use certification to enforce:
    • Metric consistency
    • Trusted KPIs
    • Enterprise reporting standards

Key Takeaways for PL-300

  • Promotion = recommended, informal trust
  • Certification = governed, enterprise-approved trust
  • Only datasets and dataflows can be certified
  • Certification requires tenant admin setup
  • Certified content supports scalable self-service BI

Practice Questions

Go to the Practice Questions for this topic.