25.3 Workspaces and Roles
Quick answer: the short, self-contained version of this lesson is the guide Power BI Workspaces and Roles.
Start with a problem
Rani wants to view reports, Raja must publish updates, and Shraddha must add new teammates. Giving everybody Admin is risky.
Explain simply
A workspace is a shared folder. Each person gets one role: Admin, Member, Contributor or Viewer. Give the lowest role that does the job.
Show the data
| Person | Workspace role | Can publish? | Can edit content? | Can manage access? |
|---|---|---|---|---|
| Ravindra | Admin | Yes | Yes | Yes |
| Shraddha | Member | Yes | Yes | Add members/viewers |
| Raja | Contributor | Yes | Yes | No |
| Rani | Viewer | No | No | No |
About this data: This table uses columns: Person, Workspace role, Can publish?, Can edit content?, Can manage access?. This table uses columns: Person, Workspace role, What she sees. This table uses columns: Person, Access, What she sees. Values shown are the lesson examples already on this page (not a new dataset).
Fictional sample data. Practice file: visuals_orders_apr_may_2026.csv (source: src/practice/).
Demonstrate
- Open the workspace › Manage access.
- Add people or groups.
- Add Ravindra Admin, Shraddha Member, Raja Contributor, Rani Viewer.
- Ask Rani to try editing – the Edit button is missing.
Show the result
Your result should look like this (fictional sample):
| Person | Workspace role | Can publish? | Can edit content? | Can manage access? |
|---|---|---|---|---|
| Ravindra | Admin | Yes | Yes | Yes |
| Shraddha | Member | Yes | Yes | Add members/viewers |
| Raja | Contributor | Yes | Yes | No |
| Rani | Viewer | No | No | No |
Explain what happened
Roles control actions on all items in the workspace. Viewer is read-only.
Explore further
- Use security groups instead of individuals in real companies.
Detailed reference for this lesson:
Workspace roles in Power BI Service with example — in 30 seconds
What: Workspace roles decide who can edit and who can only view: Admin, Member, Contributor, Viewer.
Why: RLS works only for Viewers (and app users). A city manager given Member sees every city.
Tiny example: Shraddha as Member → all cities. Shraddha as Viewer → Nashik only.
Workspace roles in Power BI Service with example — 30 सेकंदात
काय: Workspace roles ठरवतात कोण edit करू शकतो आणि कोण फक्त बघू शकतो: Admin, Member, Contributor, Viewer.
का: RLS फक्त Viewers (आणि app users) साठी चालतं. City manager ला Member दिलं तर त्याला प्रत्येक शहर दिसतं.
छोटं उदाहरण: Shraddha Member म्हणून → सगळी शहरं. Shraddha Viewer म्हणून → फक्त Nashik.
Workspace roles in Power BI Service with example — 30 सेकंड में
क्या: Workspace roles तय करते हैं कि कौन edit कर सकता है और कौन सिर्फ़ देख सकता है: Admin, Member, Contributor, Viewer.
क्यों: RLS सिर्फ़ Viewers (और app users) के लिए चलता है. City manager को Member दिया तो उसे हर शहर दिखता है.
छोटा उदाहरण: Shraddha Member के रूप में → सारे शहर. Shraddha Viewer के रूप में → सिर्फ़ Nashik.
First look at the data (before → after):
Same before / after tables as text
Before — Wrong setup
| Person | Workspace role | What she sees |
|---|---|---|
| Shraddha (Nashik) | Member | All cities (RLS ignored) |
Formula / click path
Workspace › Manage access › change Shraddha to Viewer
(or remove workspace access and share the app)
After — Right setup
| Person | Access | What she sees |
|---|---|---|
| Shraddha (Nashik) | Viewer / app audience | Nashik only |
Do it step by step:
- Open the workspace. Click Manage access.
- Find the city managers.
- Change their role to Viewer. Or remove them and give them the app.
- Test with Test as role on the semantic model.
एक-एक step करून बघा:
- Workspace उघडा. Manage access वर click करा.
- City managers शोधा.
- त्यांचा role Viewer करा. किंवा त्यांना काढून app द्या.
- Semantic model वर Test as role ने test करा.
एक-एक step करके देखिए:
- Workspace खोलिए. Manage access पर click कीजिए.
- City managers ढूँढिए.
- उनका role Viewer कीजिए. या उन्हें हटाकर app दीजिए.
- Semantic model पर Test as role से test कीजिए.
A workspace is a container for related content (semantic models, reports, dashboards, dataflows, and Fabric items). My workspace is your personal area – use it fakt for practice; real team content belongs in shared workspaces.
| Role | Can do |
|---|---|
| Admin | Everything, including managing access, deleting the workspace |
| Member | Add others (Member and below), publish, edit, share, publish/update the app |
| Contributor | Create, edit and delete content; cannot share items or manage access (by default) |
| Viewer | View and interact with content only; Row-level security applies to viewers |
Good practice
Create separate workspaces for development, test and production, or use deployment pipelines (Premium/PPU/Fabric capacity) to promote content between stages. Distribute production content to business users through an app, not by giving them workspace access.
Read the roles table carefully once. You need it to understand RLS.
Roles चा table एकदा नीट वाचा. RLS समजून घ्यायला हे गरजेचं आहे.
Roles वाली table एक बार ध्यान से पढ़िए. RLS समझने के लिए यह ज़रूरी है.
Ravindra Bagale's Tip
Friends, many students give everyone the Member or Admin role "to make access easy", and then RLS doesn't apply to them, because RLS only restricts Viewers. Give report consumers the Viewer role or app access, and keep Admin/Member/Contributor for the people who build content. Never forget this.
Ravindra Bagale's Tip – मराठी
मित्रांनो, बरेच students "access सोपा व्हावा" म्हणून सगळ्यांना Member किंवा Admin role देतात, आणि मग त्यांना RLS लागू होत नाही, कारण RLS फक्त Viewers वरच बंधन घालतं. Report यूजर्सना Viewer role किंवा app access द्या, आणि Admin/Member/Contributor content बनवणाऱ्यांसाठीच ठेवा. हे अजिबात विसरू नका.
Ravindra Bagale's Tip – हिंदी
दोस्तों, बहुत से students "access आसान करने के लिए" सबको Member या Admin role दे देते हैं, और फिर उन पर RLS लागू नहीं होता, क्योंकि RLS सिर्फ़ Viewers पर रोक लगाता है. Report देखने वालों को Viewer role या app access दो, और Admin/Member/Contributor content बनाने वालों के लिए ही रखो. यह बिल्कुल मत भूलना.
Fix common mistakes
| Wrong result | Reason | Correction |
|---|---|---|
| Rani changed a visual | Given Member | Change to Viewer |
| Raja cannot publish | Given Viewer | Contributor |
| Only one Admin left the company | Single admin | Keep two Admins |
Practise independently
Practice task
Which role for an analyst who publishes but should not manage access?
Hints
- Not Member.
Solution
Contributor.
Think like a professional
Least privilege is a security interview topic. Explain the four roles in one line each.
Deepen this topic (Why / What / How)
Fictional Maharashtra example. Numbers and workspace names below are practice data only.
Why: Wrong roles create either chaos (everyone Admin) or blockers (nobody can publish).
What: Shared workspaces hold team content; four roles follow least privilege: Admin, Member, Contributor, Viewer.
How — set least privilege:
Vertical steps (one under another)
- Create or open a shared workspace for the project.
- Add city managers as Viewer; builders as Contributor; App publishers as Member; owners as Admin.
- Never put production content only in My workspace.
- Document who owns refresh credentials.
- Continue in Ch 37 for publish + role interview stories.
Tiny example: Fictional: Sales MH — Rani Admin, Raja Contributor, Pune managers Viewer.
Ravindra Bagale's Tip
Friends, Viewer is a feature, not an insult — it protects live numbers.
Ravindra Bagale's Tip – मराठी
मित्रांनो, Viewer कमीपणा नाही — live numbers वाचवतो.
Ravindra Bagale's Tip – हिंदी
दोस्तों, Viewer कमज़ोरी नहीं — live numbers बचाता है।
Go deeper next
This Chapter 25 page is the overview. For the full Service deep lesson, open Ch 37 · Workspaces, Roles and Publishing. Chapters 37–44 are the deep Service series; Chapter 44 is the publish–secure–refresh–share capstone.
Quiz (5 questions)
1. Least privilege means:
2. City managers who only read usually need:
3. My workspace is best for:
4. Who typically publishes an App?
5. Deep lesson for workspaces/roles:
Practice tasks (12) — hints only, no full answers
- Task. Write the business question this 25 3 workspaces and roles page answers in one sentence.
Hint: Name the user and the decision. - Task. List three mistakes learners make with 25 3 workspaces and roles.
Hint: Use Fix common mistakes as a seed. - Task. Draw a 5-box flow on paper for 25 3 workspaces and roles (fictional MH Ops).
Hint: Photo counts as artefact. - Task. Explain 25 3 workspaces and roles to a friend in 60 seconds using Why/What/How.
Hint: Record voice memo if you can. - Task. Open the linked deep chapter and write three new facts not on this overview page.
Hint: Cite section titles only. - Task. Create a checklist of 7 ticks before you call 25 3 workspaces and roles “done”.
Hint: Include a verify step. - Task. Invent fictional refresh/share/role data that fits 25 3 workspaces and roles.
Hint: Keep IST times. - Task. Map who is Admin / Member / Contributor / Viewer for a fictional workspace using 25 3 workspaces and roles.
Hint: Least privilege. - Task. Write an interview STAR story that uses 25 3 workspaces and roles.
Hint: 45–60 seconds. - Task. Find one unused habit you will stop (e.g. My workspace for team content) related to 25 3 workspaces and roles.
Hint: Be specific. - Task. Link 25 3 workspaces and roles forward to the correct Ch 37–44 lesson and say why.
Hint: One sentence why. - Task. Teach 25 3 workspaces and roles back using Marathi or Hindi tip language once.
Hint: Keep English terms for product UI.
Revision card
Interview card