Microsoft Fabric workspace roles: Admin, Member, Contributor and Viewer

Workspace roles are Admin, Member, Contributor and Viewer. Fabric extends the original Power BI roles with data engineering, warehousing and real-time capabilities, so the capability matrix is the core of this objective.

Fabric capability matrix

Capability	Admin	Member	Contributor	Viewer
Update and delete the workspace	Yes	No	No	No
Add or remove people, including other admins	Yes	No	No	No
Add members or others with lower permissions	Yes	Yes	No	No
Allow others to reshare items	Yes	Yes	No	No
Create a workspace identity	Yes	No	No	No
Connect the workspace to a Git repository	Yes	No	No	No
Create or modify warehouse, database and mirrored database items	Yes	Yes	Yes	No
Write or delete pipelines, notebooks, Spark job definitions, eventstreams, eventhouses, KQL querysets, lakehouse and warehouse data, shortcuts	Yes	Yes	Yes	No
Execute or cancel notebooks, Spark job definitions and pipelines	Yes	Yes	Yes	No
Connect to the SQL analytics endpoint or warehouse	Yes	Yes	Yes	Yes
Read lakehouse and warehouse data with T-SQL (ReadData)	Yes	Yes	Yes	Yes
Read lakehouse and warehouse data through Spark and OneLake APIs, or the Lakehouse explorer (ReadAll)	Yes	Yes	Yes	No
Subscribe to OneLake events	Yes	Yes	Yes	No
View pipeline, notebook and experiment content and execution output	Yes	Yes	Yes	Yes
Schedule refreshes through an on-premises gateway, modify gateway connection settings	Yes	Yes	Yes	No

Shortcut data and gateway operations also need permissions on the shortcut target or the gateway, which are managed separately from workspace roles.

Power BI capabilities by role

Capability	Admin	Member	Contributor	Viewer
Publish, unpublish and change permissions for an app	Yes	Yes	No	No
Update an app	Yes	Yes	If the Admin allows it	No
Share items, including semantic models, and allow resharing	Yes	Yes	With Reshare	With Reshare
Create, edit and delete content	Yes	Yes	Yes	No
Build a report in another workspace on a semantic model here	Yes	Yes	Yes	No
Analyze in Excel, download a PBIX	Yes	Yes	Yes	No (Viewers need Build for Analyze in Excel)
Manage subscriptions created by others	Yes	No	No	No
View and interact with items	Yes	Yes	Yes	Yes

How role assignment behaves

Roles can be assigned to individuals, security groups, mail-enabled security groups, Microsoft 365 groups and distribution lists. Everyone in a group gets the role, nested groups pass it on, and a user in several groups gets the highest role.
Members can add people only as Member, Contributor or Viewer, and can’t change or remove existing users’ roles. To upgrade a Viewer to Contributor, an Admin must change the role, or remove the user so that a Member can add them back with the new role.
Changes to workspace access take effect the next time the user signs in to Fabric.
A workspace can have at most 1,000 users or groups in its roles (a group counts once, however many members it has).
The workspace creator is automatically an Admin.
On a shared-capacity (Pro) workspace, everyone added needs Pro or PPU. On F64 or larger (or P), Free-licence users can use the Viewer role, but only if they have no higher role.
Viewers are the only role that semantic model row-level security restricts; Admin, Member and Contributor bypass RLS. Learn recommends Viewer (or an app, or sharing) for consumers who must be filtered by RLS.
Disabling a user in Microsoft Entra ID doesn’t remove their workspace and item access records; they’re kept until the user is permanently deleted, but the disabled user can’t use them.

Common trap: Giving a Member the job of connecting the workspace to Git or creating a workspace identity - both are Admin-only actions.

Common trap: Expecting Viewers to explore a lakehouse in a notebook - Viewers can read through the SQL analytics endpoint (ReadData) but not through Spark, OneLake APIs or the Lakehouse explorer (ReadAll), unless a OneLake security role or item permission grants it.

Common trap: Asking a Member to promote a Viewer to Contributor - Members can add people with the same or lower role but can’t change existing users’ roles.

Get the whole book

This note is one section of Ultra Transcenders DP-600: Implementing Analytics Solutions Using Microsoft Fabric, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

Amazon.co.ukKindle: coming soonPaperback: coming soon

Amazon.comKindle: coming soonPaperback: coming soon

Due on Amazon in December 2026, in Kindle and paperback editions.

About the book · DP-600 terms in the glossary · All DP-600 study notes

More DP-600 study notes

Direct Lake on OneLake vs Direct Lake on SQL analytics endpoint
How the two Direct Lake flavours differ in table discovery, permission checks, fallback and unsupported cases, and which one to choose.
Choosing a Power BI storage mode: Import, DirectQuery, Dual or Direct Lake
When each table storage mode fits a semantic model, based on data size, latency, source security and capacity.
Fabric deployment pipelines: what gets copied and how deployment rules work
Which items and settings a deployment copies or leaves alone, and how data source and parameter rules point each stage at its own data.
Choosing a Fabric data store: lakehouse, warehouse, eventhouse or SQL database
How data type, team skills, write needs and transactions decide between Fabric's lakehouse, warehouse, eventhouse and other stores.
Fabric Warehouse vs lakehouse SQL analytics endpoint
What the Warehouse can do that a lakehouse's read-only SQL analytics endpoint can't, and when to use each.
Many-to-many relationships and bridge tables in Power BI
The three many-to-many scenarios in a semantic model and the bridge-table or relationship design each one needs.
Choosing a Fabric ingestion tool: Copy job, pipelines, Dataflow Gen2, notebooks or eventstreams
How data volume, transformation needs, skills and latency decide which Fabric tool should copy data into OneLake.