PL 400 Security and Compliance 4 — Questions and Answers
Question 1: A developer creates a custom API in Dataverse that should only be callable by other Dataverse processes, not external users. Which privilege controls this?
- Assign the API a 'prvCallCustomAPI' privilege restricted to System roles
- Set the API binding type to Entity and restrict table access
- Mark the API as 'Is Private' in its definition (Correct answer)
- Configure a custom connector to wrap the API with OAuth
Correct answer: Mark the API as 'Is Private' in its definition
Setting a custom API as private prevents it from being discovered or called by external clients, limiting its use to internal Dataverse plugins and workflows.
Question 2: When configuring a Dataverse plugin to run in the context of a specific user rather than the calling user, which approach should the developer use?
- Set the plugin step to run as the System Administrator
- Use IOrganizationService impersonation with the target user's ID (Correct answer)
- Add a shared variable to the plugin context with the user ID
- Configure the plugin assembly to use a service account
Correct answer: Use IOrganizationService impersonation with the target user's ID
The Dataverse plugin SDK supports impersonation by passing the initiating user's ID to IOrganizationServiceFactory.CreateOrganizationService(), allowing operations to run in that user's security context.
Question 3: A company wants to prevent Power Platform users from exporting data from Dataverse to Excel. Which setting achieves this?
- Disable the Export to Excel privilege in all security roles (Correct answer)
- Enable DLP policies blocking the Excel Online connector
- Set environment data policies to restrict export operations
- Use Conditional Access to block Excel application access
Correct answer: Disable the Export to Excel privilege in all security roles
Removing the 'Export to Excel' miscellaneous privilege from security roles prevents users from exporting Dataverse data to Excel directly from model-driven apps.
Question 4: In Power Platform, what is the purpose of 'Environment Security Groups' in the Power Platform admin center?
- To define which DLP policies apply to the environment
- To restrict who can access the environment by limiting it to group members (Correct answer)
- To assign Dataverse security roles automatically based on group membership
- To control which Azure subscriptions can host the environment
Correct answer: To restrict who can access the environment by limiting it to group members
Setting a security group on an environment restricts environment access so only members of that Azure AD group can log in and use apps within it.
Question 5: A developer needs to ensure that a Power Automate flow's service principal has the minimum required Dataverse permissions. Which role should be assigned to an application user for read-only reporting flows?
- System Administrator
- System Customizer
- A custom security role with only Read privileges on required tables (Correct answer)
- Delegate access through an owner team
Correct answer: A custom security role with only Read privileges on required tables
Creating a custom security role with only the necessary read privileges follows least privilege principles and limits the blast radius of a compromised service principal.
Question 6: Which Microsoft compliance feature can be used to apply sensitivity labels to data exported from Dataverse through Power BI?
- Azure Information Protection labels via Microsoft Purview (Correct answer)
- DLP policies in the Power Platform admin center
- Power BI workspace security settings
- Dataverse auditing and alert policies
Correct answer: Azure Information Protection labels via Microsoft Purview
Microsoft Purview Information Protection sensitivity labels can be applied to Power BI reports and datasets, including those sourced from Dataverse.
Question 7: A developer is implementing a canvas app that connects to Dataverse. They want the app to always use the signed-in user's permissions rather than a shared service account. Which connection type ensures this?
- Use a connection reference with embedded credentials
- Connect using 'Connect with the logged in user' (non-embedded) connection (Correct answer)
- Create a connection reference pointing to an application user
- Use an on-premises data gateway connection
Correct answer: Connect using 'Connect with the logged in user' (non-embedded) connection
Non-embedded connections in canvas apps pass through the signed-in user's identity to Dataverse, ensuring Dataverse security roles apply per individual user.
PL 400 Security and Compliance 4
A developer creates a custom API in Dataverse that should only be callable by other Dataverse processes, not external users.
Which privilege controls this?