Granting and restricting access at the workspace level

Microsoft Fabric workspaces use role-based access control to manage who can view, edit, or administer items within a workspace, separate from item-level sharing permissions. Understanding the four built-in workspace roles and how they interact with Microsoft Entra ID (formerly Azure AD) security groups is essential for implementing least-privilege access in an analytics solution.

Must-know

• Fabric workspaces support four built-in roles: Admin, Member, Contributor, and Viewer, each granting progressively fewer permissions over workspace management and item operations.
• Admins can manage workspace access, delete the workspace, and change workspace settings (including OneLake data access rules and Git integration); Members can additionally manage access for Contributor and Viewer roles but not Admins.
• Contributors can create, edit, and delete items within the workspace but cannot manage workspace-level access or settings, while Viewers have read-only access to workspace content.
• Roles can be assigned to individual users, Microsoft Entra security groups, distribution lists, or Microsoft 365 groups, and using security groups is the recommended practice for scalable governance.
• Workspace roles grant access to all items in the workspace by default, but item-level sharing can grant more granular permissions (e.g., Read or ReadWrite) to specific reports, semantic models, or lakehouses without granting full workspace access.
• Workspace access control is separate from OneLake data access roles, which allow more granular, folder-level security within a lakehouse independent of the broader workspace role assignments.

Coverage checked against the published exam guide on Aug 11, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.