Workspace Access Controls
Secure your Fabric workspace. Workspace roles, item-level permissions, and the principle of least privilege — the first layer of Fabric security.
Securing Fabric workspaces
Think of workspace security like access cards in an office building.
Some people have a master key (Admin) — they can open every door. Others have a team card (Member) — they can access their floor but not the server room. Visitors get a guest badge (Viewer) — they can walk around and look, but they cannot change anything.
In Fabric, workspace roles are the access cards. They control who can create, modify, share, and view items in the workspace. Item-level permissions are like individual office locks — even if you have floor access, some rooms require additional approval.
Workspace roles
| Capability | Admin | Member | Contributor | Viewer |
|---|---|---|---|---|
| View items and read data | Yes | Yes | Yes | Yes |
| Create and edit items | Yes | Yes | Yes | No |
| Share items with others | Yes | Yes | No | No |
| Manage workspace settings and roles | Yes | No | No | No |
| Delete workspace | Yes | No | No | No |
| Publish content | Yes | Yes | Yes | No |
Best practices
- Viewers for report consumers
- Contributors for data engineers and report builders
- Members for team leads who need to share content
- Admins for workspace owners only (1-2 people)
- Use Entra ID security groups for scalable management
Item-level permissions
You can share specific items with users who are NOT workspace members:
| Permission | What It Grants |
|---|---|
| Read | View the report or query the model |
| Build | Create new reports on top of a shared semantic model |
| Reshare | Share the item with other users |
Exam tip: Build permission
Build lets a user create their own reports using a shared semantic model. It does NOT let them edit the model. Build is granted via item sharing, NOT via workspace roles. A workspace Viewer + model Build permission = can view reports AND create their own.
James needs a junior analyst to build reports but NOT share them externally. Which role?
Raj at Atlas Capital shares a semantic model with 20 analysts via item sharing with Build permission. The analysts are NOT workspace members. Can they create reports on the model?
Next up: Row-Level & Object-Level Security — control what data users see.