Controlling access to data is one of the most important responsibilities in any analytics environment. Microsoft Fabric uses workspace roles to determine what users can see and do within a workspace. Understanding these roles and their permissions is essential for maintaining security while ensuring that team members have the access they need to perform their work.
This topic focuses on implementing workspace-level access controls and understanding how permissions are assigned and managed.
Understanding Workspace Roles
Microsoft Fabric uses Power BI workspace roles for Fabric capabilities. Each role grants a different level of access and responsibility.
Viewer
The Viewer role is designed for users who primarily need to consume content.
Viewers can:
- View and read the content of data pipelines and notebooks,
- Execute and cancel execution of data pipelines (but not notebooks),
- View execution output from data pipelines and notebooks,
- Connect to and read data or shortcuts through a Lakehouse or Warehouse SQL analytics endpoint, and
- Reshare workspace items if they have been granted Reshare permissions.
This role is suitable when users need visibility into analytics assets without making changes.
Contributor
The Contributor role includes all Viewer permissions, plus additional capabilities for development and maintenance.
Contributors can:
- Read Lakehouse and Warehouse data through OneLake APIs and Spark,
- Read Lakehouse data through Lakehouse Explorer,
- Create, modify, and delete data pipelines and notebooks,
- Execute and cancel notebook execution,
- Schedule data refreshes through the on-premises gateway, and
- Modify gateway connection settings.
This role is often assigned to developers and analysts who actively build and maintain Fabric solutions.
Member
Members have all Contributor capabilities and can also manage workspace access.
Members can:
- Add Members, Contributors, and Viewers, and
- Allow other users to reshare items.
This role is useful for team leads and trusted users who help manage workspace collaboration.
Admin
The Admin role provides the highest level of workspace control.
Admins can:
- Update and delete the workspace, and
- Add or remove Admins, Members, Contributors, and Viewers.
Workspace administrators are responsible for governance, security, and overall workspace management.
Choosing the Right Role
A common principle when assigning permissions is to provide the minimum level of access required.
For example:
- Consumers of reports and analytics content may only require Viewer access,
- Developers creating notebooks and pipelines may require Contributor access,
- Team leads who manage workspace membership may require Member access, and
- Platform administrators typically require Admin access.
Applying the least-privilege principle helps reduce security risks while maintaining productivity.
Granting Workspace Access
Adding users to a workspace is straightforward.
To grant access:
- Open the workspace,
- Select Manage Access,
- Choose + Add people or groups,
- Enter the user name or email address,
- Select the appropriate role, and
- Click Add.
Access permissions can be reviewed and modified later as requirements change.
Workspace Security and the Bigger Picture
Workspace-level access controls determine who can enter a workspace and what actions they can perform. However, they are only one layer of security.
In many scenarios, additional controls are required:
- Sharing and managing permissions for individual items such as reports, notebooks, and lakehouses, #see topic 2#
- Restricting access to specific rows, columns, objects, or files within data sources, #see topic 3#
- Applying sensitivity labels to classify and protect content, #see topic 4#
- Endorsing trusted content so users can identify approved assets, #see topic 5#
Together, these features create a comprehensive security model across Microsoft Fabric.
Why Workspace-Level Access Matters
Workspace permissions provide the foundation for secure collaboration. By assigning the appropriate role to each user, organisations can:
- Protect analytics assets,
- Enable collaboration between developers and business users,
- Control administrative responsibilities, and
- Reduce the risk of accidental or unauthorised changes.
A well-designed permission structure makes it easier to manage large analytics environments while maintaining security and governance standards.
Conclusion
Workspace-level access controls are the first layer of security in Microsoft Fabric. Understanding the Viewer, Contributor, Member, and Admin roles allows you to grant appropriate access while maintaining control over your analytics environment.
For the DP-600 exam, you should understand the permissions associated with each role, know when each role should be used, and be familiar with the process for granting and managing workspace access.
What’s Next
Workspace-level access controls establish the foundation for secure collaboration in Microsoft Fabric. Once users have access to a workspace, you can further refine security through item-level permissions, data-level security, sensitivity labels, and content endorsement.
Further reading
DP-600 exam topic guide
Microsoft Learn resources for DP-600
If you prefer a structured learning experience, a video course covering these topics in more depth is also available.