Maintain a Data Analytics Solution · Topic 1 of 5
Workspace and Item Access Controls
Fabric workspace roles Admin, Member, Contributor and Viewer, item permissions such as Read, ReadData, ReadAll and Build, and least privilege sharing.
- 5 min
- Four workspace roles: Admin, Member, Contributor, Viewer. Only Admin deletes the workspace or adds Admins.
- Member can add people with the same or lower role and can share items; Contributor cannot.
- Viewer reads data with T-SQL through the SQL analytics endpoint but not with Spark.
What it is
Microsoft Fabric controls access at two levels. Workspace roles give a person or group the same rights over every item in a workspace. Item permissions give access to one item, such as a single lakehouse, warehouse or semantic model, without adding the person to the workspace.
Both levels sit on top of the tenant settings that a Fabric administrator controls. Inside the data, finer controls such as row-level security narrow access further; those are on the next page.
How it works
Workspace roles
A workspace has four roles. You can assign them to users, security groups, Microsoft 365 groups and service principals. Groups are the recommended choice because membership is managed in one place.
| Capability | Admin | Member | Contributor | Viewer |
|---|---|---|---|---|
| Delete the workspace, add or remove Admins | Yes | No | No | No |
| Add Members, Contributors and Viewers | Yes | Yes | No | No |
| Share items and allow others to reshare | Yes | Yes | No | No |
| Create, edit and delete items, run refreshes and pipelines | Yes | Yes | Yes | No |
| Read lakehouse data through Spark and OneLake APIs | Yes | Yes | Yes | No |
| Read lakehouse and warehouse data with T-SQL | Yes | Yes | Yes | Yes |
| View and interact with reports and other items | Yes | Yes | Yes | Yes |
The key line for the exam is the Spark one. A Viewer can query a lakehouse through its SQL analytics endpoint but cannot read the files or tables with a notebook.
Admin, Member and Contributor can all edit, so data security rules such as semantic model row-level security do not restrict them. Only Viewers and people with item-level read access are filtered.
Item permissions
You grant item permissions with the Share option on the item or with Manage permissions. The person does not appear in the workspace list; they find the item through the OneLake catalog or a link.
| Permission | What it allows | Typical item |
|---|---|---|
| Read | Connect to the item and see its metadata | Lakehouse, warehouse, semantic model, report |
| ReadData | Read all tables through the SQL analytics endpoint or warehouse with T-SQL | Lakehouse, warehouse |
| ReadAll | Read the underlying OneLake files, for example with Spark | Lakehouse, warehouse |
| Build | Create new reports and composite models on a semantic model | Semantic model |
| Write | Edit the item | Any item |
| Reshare | Share the item with other people | Any item |
Read on its own grants no data. With Read only, a warehouse user can connect, and an administrator then grants table access with T-SQL GRANT statements.
Semantic models and reports
Sharing a report also gives the recipient Read on the semantic model behind it, so the report can show data. Build is excluded by default and is granted only if the person sharing includes it. An analyst who wants to create a new report on a shared model from another workspace needs Build on that model.
Workspace apps are another way to publish reports to a large audience. App audiences see the content but are not added to the workspace.
A worked example
A sales workspace holds a lakehouse, a semantic model and reports. Four groups need access:
- Regional managers only open reports. Give them the Viewer role, or an app, and they are also subject to the model's row-level security.
- Finance analysts in another workspace build their own reports. Give them Build on the semantic model and nothing on the workspace.
- A data scientist reads lakehouse tables from her own notebook. Share the lakehouse with ReadAll.
- SQL analysts query the lakehouse with T-SQL. Share the lakehouse with ReadData, or give them Viewer if they also need the reports.
Nobody in this list needs Contributor, because nobody creates or edits items in the sales workspace.
"Without giving access to other items in the workspace" in a question is a strong hint for an item permission rather than a workspace role.
How the exam asks about this
- "A user must create and edit notebooks but must not manage workspace access." Contributor.
- "A user must query a lakehouse with Spark but has no workspace role." Share the lakehouse with ReadAll.
- "An analyst must build a report on a semantic model in another workspace." Build permission on the semantic model.
What to remember for the exam
- Four workspace roles: Admin, Member, Contributor, Viewer. Only Admin deletes the workspace or adds Admins.
- Member can add people with the same or lower role and can share items; Contributor cannot.
- Viewer reads data with T-SQL through the SQL analytics endpoint but not with Spark.
- Item permissions: Read, ReadData (T-SQL), ReadAll (OneLake and Spark), Build, Write, Reshare.
- Assign roles to security groups, not to individual users, wherever you can.
Semantic model row-level security does not filter workspace Admins, Members or Contributors. If the test user still sees every row, check their workspace role first.
Common mistakes
Giving Contributor to people who only read. Contributor can edit and delete every item in the workspace. Viewer or an item permission is enough for reading.
Assuming Read on a lakehouse returns data. Read only lets the user connect. They also need ReadData for T-SQL, ReadAll for Spark, or table-level GRANT statements.
Expecting a shared report to allow new reports. By default, sharing a report gives Read on its model, not Build. Building new content needs Build on the semantic model.
Check yourself
Which workspace role is the lowest that can create and edit items?
Contributor. It can create, edit and delete items but cannot add people or share items.
A user with the Viewer role cannot load a lakehouse table in a notebook. Why?
Viewers can read lakehouse data only through the SQL analytics endpoint. Reading through Spark needs Contributor or higher, or the ReadAll item permission.
What must an analyst have to build a new report on a semantic model in another workspace?
Build permission on that semantic model. A workspace role is not required.
Topic 1 of 5 in Maintain a Data Analytics Solution
Test yourself on Maintain a Data Analytics Solution
The full Microsoft DP-600 question bank has 648 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.