Power BI workspace roles: who can do what, and why it matters
Power BI workspace roles are four permission levels, Admin, Member, Contributor and Viewer, that decide what each person can do in a workspace. Pick too high and people can change content they should only read. Pick too low and work stalls. So a short, deliberate plan pays off. This guide compares the four and shows how to assign them.
- Four roles to choose
- Groups beat individuals
- Viewer enforces security
Last updated
What are Power BI workspace roles?
A workspace is a shared container for reports, semantic models and other items. Roles control what each person may do inside it. Microsoft defines four: Admin, Member, Contributor and Viewer.
You can give a role to one person or to a group. Security groups, Microsoft 365 groups and distribution lists all work. When someone belongs to several groups, Microsoft says they receive the highest permission among them.
That last rule surprises people. For example, a colleague may be a Viewer through one group and a Member through another. The Member role wins, so check group membership before you trust a list.
Admin, Member, Contributor and Viewer compared by task
Each task below needs at least the role shown. Higher roles can do it too.
| Task | Lowest role that can do it | Note |
|---|---|---|
| View and interact with reports | Viewer | Every role can do this |
| Create, edit and delete content | Contributor | Includes publishing reports to the workspace |
| Schedule refresh through a gateway | Contributor | Gateway permissions are also necessary |
| Publish and update the app | Member | A Contributor can update it if an Admin allows |
| Share items and allow resharing | Member | Covers semantic model permissions too |
| Add people with lower permissions | Member | Removing people stays with Admins |
| Add or remove other admins | Admin | Only an Admin manages admins |
| Update or delete the workspace | Admin | Keep more than one Admin |
How should you assign Power BI workspace roles?
Start from the lowest role that lets someone do the job. Most readers need Viewer, or no role at all when they use an app. Report builders need Contributor. Only a few people need Member or Admin.
Use groups, not names. A security group per role keeps the access list short. Then joiners and leavers become a change in the group, and the workspace follows.
Keep at least two Admins. Otherwise one departure can leave a workspace without an owner. Also, review the list on a schedule, because access granted for a project tends to stay long after it ends.
Steps to set Power BI workspace roles for a new team
A little planning comes first, so the access pane is the third step and not the first.
List the jobs
First, write down who reads, who builds and who publishes. The right level follows from those jobs.
Create the groups
Then ask IT for one security group per level, and add people to the groups.
Grant access in the workspace
Next, open the access settings of the workspace, add each group and choose its level.
Test as a reader
Finally, ask one person from each group to confirm what they can and cannot do.
Why does the Viewer role matter for row-level security?
Row-level security limits which rows a person sees. However, Microsoft explains that it applies in practice to Viewers. Admins, Members and Contributors hold edit permission on the model, so the restriction does not bind them.
The consequence is simple. If a sales manager should see one region only, that manager must be a Viewer or reach the report through an app. Giving Contributor for convenience removes the filter.
Licenses interact with access as well. Microsoft states that every capability except viewing needs a Pro or Premium Per User license. In a workspace on a Premium capacity, Viewers can read content without a Pro license. Details change, so confirm against Microsoft's current documentation.
Access level questions from workspace owners
Which Power BI workspace roles can publish an app?
Admins and Members can publish, update and unpublish the app for a workspace. Contributors cannot by default. However, an Admin can switch on a workspace setting that lets Contributors update the app. Viewers have no part in it. So if your report builders should release their own changes, decide that on purpose and record who agreed to it.
Do Power BI workspace roles override row-level security?
In effect, yes, for the three higher levels. Row-level security restricts people who only have read access. Admins, Members and Contributors can edit the semantic model, so the filters do not limit what they see. Therefore give restricted readers the Viewer level, or serve them through an app, and keep the higher levels for the team that builds.
Can a Member remove someone from a workspace?
According to Microsoft's table, Members can add other members and people with lower permissions. Removing users and changing the level of an existing user remain with Admins. That split stops a Member from locking out colleagues. If your team needs someone to manage access day to day, make that person an Admin.
What can a Contributor do that a Viewer cannot?
A Contributor can create, edit and delete content in the workspace, which includes publishing reports to it. The same person can also schedule refreshes when they hold gateway permissions, and can use Analyze in Excel. A Viewer can read and interact with content and set up personal subscriptions. In short, Contributors build, while Viewers read.
Can you review our workspace access?
Yes. Power BI Agency audits workspaces, access levels and groups, and then proposes a simpler model in writing. We carry out the review online inside your own tenant, with your administrators in control. The team is small and experienced, part of Sataware Technologies, and independent of Microsoft. Ask for a free 30-minute assessment and we reply within 2 hours.
Let's build your first dashboard together.
Tell us what you report on today. A consultant replies within 2 hours with next steps.
Trusted partners
Microsoft Solutions Partner · AWS Partner
Cloud & AI Platforms
Azure SQL, Microsoft Fabric and the data pipelines behind your reports.
AI Business Solutions
Power BI reporting on your Dynamics 365, Business Central and Power Platform data.
Security
Row-level security and Entra ID sign-in on every report and workspace.
Amazon Web Services
Power BI on your AWS data, with connectors for Redshift, Athena and S3.