Workspace and Item Access Controls

Playback speed

Swipe, scroll or use ← →

Choose the access scope first

Microsoft Fabric uses a layered security model so access can be assigned at the level that matches a user's needs. The first decision is not which permission but how wide.

Workspace roles apply to every item in a workspace, so they fit users who need broad access across multiple items. Workspace roles can be assigned to individuals, security groups, Microsoft 365 groups, and distribution lists.

The scope decision comes first: use a workspace role for broad collaboration across the workspace, or item permissions for access to a specific item.

1 / 19
Quick check

A user needs broad access across many items in the same workspace. Which mechanism fits?
1. AAn item permission
  
  An item permission applies to one shared item, so it does not cover the rest of the workspace.
2. BA workspace role, which applies to every item there
  
  Right. Workspace roles apply to every item in the workspace, which is exactly the broad access described.
3. CA lakehouse Read permission granted separately on each item in turn
  
  Repeating an item permission item by item is the item-scoped mechanism used in the wrong place.
2 / 19
Know the four workspace roles

Fabric has four workspace roles, and each one adds a capability to the one below it.

Role Create View Modify Share Manage permissions

Admin Yes Yes Yes Yes Yes

Member Yes Yes Yes Yes No

Contributor Yes Yes Yes No No

Viewer No Yes No No No

An Admin can create, view, modify, share, and manage all workspace content and data, and can manage permissions. A Member can create, view, modify, and share all workspace content and data.

3 / 19
Know the four workspace roles

A Contributor can create, view, and modify all workspace content and data, but the role does not add the Member's sharing capability or the Admin's permission-management capability. A Viewer can view all workspace content but cannot modify it.

The two lines that separate the roles are worth naming out loud: sharing separates Member from Contributor, and permission management separates Admin from Member.

4 / 19
Quick check

A data engineer must create and modify items throughout a workspace, but must not share content or manage permissions. Which role is the least-privileged fit?
1. AContributor, which creates and modifies without sharing
  
  Right. Contributor covers workspace-wide creation and modification and stops short of both excluded capabilities.
2. BMember
  
  Member adds the sharing capability that the requirement explicitly rules out.
3. CViewer
  
  Viewer cannot create or modify the items the engineer has to work on.
5 / 19
Remember what a Viewer does not get

Viewer is the role most often misread, because seeing an item and reading its data are not the same thing.

Viewers can see Fabric items listed in the workspace, but they have no access to the underlying OneLake data by default. The lakehouse appears in the list, its name and description are visible, and a query through Spark or the OneLake APIs still returns nothing.

That default is what makes a narrow, purpose-built data grant meaningful later: there is nothing to subtract from.

6 / 19
Quick check

What does a Viewer get by default in a Fabric workspace?
1. AThe ability to modify workspace content, but no SQL access
  
  Viewer can view all workspace content but cannot modify it; modification starts at Contributor.
2. BSharing rights, plus access to the underlying OneLake data
  
  Viewer includes neither sharing nor default access to the underlying OneLake data.
3. CA view of listed content, with no OneLake data access
  
  Right. Viewers see the items listed in the workspace and have no underlying OneLake data access by default.
7 / 19
Keep your progress in the app

That’s 3 of 8 quick checks. In the app they stay answered, and every lesson remembers where you left off.

Get the app Keep reading here
Assign a role with least privilege

Use Manage access in the workspace to enter a user and assign a workspace role. Choose the least-privileged role that still supplies every required capability.

For example, a user who must create items and read an existing lakehouse can use Contributor without receiving share or permission-management capabilities. Reading the requirement for the capabilities it withholds is usually faster than reading it for the ones it grants.

8 / 19
Quick check

Where do you enter a user and give them a workspace role?
1. AManage permissions
  
  Manage permissions configures access to one selected item rather than membership of a workspace role.
2. BManage access, in the workspace
  
  Right. Manage access is the workspace surface for entering a user and choosing their role.
3. CRead all SQL endpoint data, on the lakehouse
  
  That is a sharing capability on one lakehouse, not a place where workspace roles are assigned.
9 / 19
Limit access to one item

Item permissions apply to a single Fabric item, such as one lakehouse or warehouse. Share an individual item when a user needs that item without workspace-wide access.

For an item in a workspace, open its ellipsis menu and select Manage permissions to configure this access. The two surfaces are deliberately different: workspace roles live in Manage access, item permissions live on the item itself.

10 / 19
Quick check

A user needs one lakehouse and nothing else in the workspace. What do you use?
1. AItem permissions, configured from the item's Manage permissions menu
  
  Right. Item permissions apply to a single item, which is what sharing one lakehouse requires.
2. BThe Contributor workspace role
  
  Contributor reaches every item in the workspace and adds create and modify capabilities as well.
3. CThe Viewer workspace role
  
  Viewer still applies across the whole workspace rather than to the single item requested.
11 / 19
Understand what lakehouse Read gives

Sharing a lakehouse always grants Read permission. What Read covers is narrower than it sounds.

Read lets the recipient see item metadata and associated reports, but it does not provide access to underlying data through SQL or OneLake.

12 / 19

Role	Create	View	Modify	Share	Manage permissions
Admin	Yes	Yes	Yes	Yes	Yes
Member	Yes	Yes	Yes	Yes	No
Contributor	Yes	Yes	Yes	No	No
Viewer	No	Yes	No	No	No

Understand what lakehouse Read gives

So Read is the right answer precisely when the requirement has two boundaries: one item only, and no querying of the data behind it.

The requirement allows	Grant
Metadata and associated reports on one lakehouse	Read alone
T-SQL queries against that lakehouse	Read, plus the SQL endpoint permission
Spark or OneLake API reads	Read, plus the Apache Spark permission

13 / 19

Quick check

An analyst must see one lakehouse's metadata and associated reports, but must not query its underlying data or reach other workspace items. What do you grant?
1. AViewer, plus Read all SQL endpoint data on the lakehouse
  
  Viewer spans the whole workspace, and the SQL endpoint permission would allow the queries the requirement forbids.
2. BThe lakehouse shared with Apache Spark and event access
  
  The Apache Spark permission grants underlying data access, which this scenario excludes.
3. CThe lakehouse shared with Read
  
  Right. Read covers item metadata and associated reports on that one lakehouse and nothing underneath it.
14 / 19
Add only the capabilities needed

Additional lakehouse permissions can provide separate capabilities: Read all SQL endpoint data permits T-SQL reads from the SQL analytics endpoint; Read all Apache Spark and subscribe to events permits reads through Apache Spark and OneLake APIs; and Build reports on the default semantic model permits report creation on that model.

Each one opens a different door, and none of them implies the others.

15 / 19
Add only the capabilities needed

Note the reach as well as the path. The two additional data-access permissions grant access to all lakehouse data by default, which is why a narrower grant belongs in a OneLake security role rather than here.

When the requirement is T-SQL access to all of one lakehouse's data and nothing wider, share that lakehouse and add Read all SQL endpoint data without the Spark permission or a workspace role. Then grant only the item capabilities the recipient actually needs.

16 / 19
Quick check

A contractor needs T-SQL access to all data in one lakehouse, but no Spark access and no workspace membership. What do you configure?
1. AShare the lakehouse and add Read all SQL endpoint data
  
  Right. That permission supplies T-SQL reads at item scope, without the separate Spark path or workspace-wide membership.
2. BShare the lakehouse with Read alone
  
  Read alone exposes metadata and associated reports and provides no underlying T-SQL access.
3. CAssign the Viewer workspace role
  
  Viewer is workspace-scoped and provides no underlying OneLake data access by default.
17 / 19
Key takeaways
- Workspace roles cover every item in a workspace, while item permissions target one item.
- Contributor can create and modify content without the sharing and permission-management capabilities of higher roles.
- Lakehouse Read exposes metadata and associated reports, not underlying SQL or OneLake data.
- Decide the scope first, then grant only the capabilities the recipient actually needs.
18 / 19
Quick check

Which summary keeps the scopes and the lakehouse permissions straight?
1. AItem permissions cover the workspace, and lakehouse Read already includes SQL and OneLake data
  
  Both halves are wrong: item permissions apply to a single item, and Read stops short of the underlying data.
2. BWorkspace roles cover every item, item permissions target one, and lakehouse Read stops at metadata and reports
  
  Right. Broad scope, narrow scope, and the boundary of what a shared lakehouse's Read actually exposes.
3. CWorkspace roles target one item, item permissions cover the workspace, and Contributor is the role that manages permissions for everyone else
  
  The two scopes are swapped, and permission management belongs to Admin rather than Contributor.
19 / 19
8 quick checks · then the test

In the app, finishing the quick checks opens this lesson’s 10-question test, and the ones you miss come back exactly when you’re about to forget them.

Take this lesson’s test → Next lesson: Granular Data Access Controls Get the app

← Previous Keep your progress · Get the app Next card →

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app

Workspace and Item Access Controls

Choose the access scope first

Know the four workspace roles

Remember what a Viewer does not get

Keep your progress in the app

Assign a role with least privilege

Limit access to one item

Understand what lakehouse Read gives

Add only the capabilities needed

Key takeaways

8 quick checks · then the test

The whole course, on your phone