Granting and restricting access at the workspace level

Microsoft Fabric workspaces use role-based access control to manage who can view, edit, or administer items within a workspace, separate from item-level sharing permissions. Understanding the four built-in workspace roles and how they interact with Microsoft Entra ID (formerly Azure AD) security groups is essential for implementing least-privilege access in an analytics solution.

1 · Learn the must-know

• 1Fabric workspaces support four built-in roles: Admin, Member, Contributor, and Viewer, each granting progressively fewer permissions over workspace management and item operations.
• 2Admins can manage workspace access, delete the workspace, and change workspace settings (including OneLake data access rules and Git integration); Members can additionally manage access for Contributor and Viewer roles but not Admins.
• 3Contributors can create, edit, and delete items within the workspace but cannot manage workspace-level access or settings, while Viewers have read-only access to workspace content.
• 4Roles can be assigned to individual users, Microsoft Entra security groups, distribution lists, or Microsoft 365 groups, and using security groups is the recommended practice for scalable governance.
• 5Workspace roles grant access to all items in the workspace by default, but item-level sharing can grant more granular permissions (e.g., Read or ReadWrite) to specific reports, semantic models, or lakehouses without granting full workspace access.
• 6Workspace access control is separate from OneLake data access roles, which allow more granular, folder-level security within a lakehouse independent of the broader workspace role assignments.

2 · Check your understanding