Level 2 · Give each colleague the right workspace role

A workspace is a shared folder in the Power BI Service where a team keeps the things it builds together: reports, semantic models, dashboards, dataflows. Everyone in it has one of four roles, and the role decides what they can do.

What you are working in

This is a quiz: workspace roles live in the Service, which needs a work account. To do it for real, open the workspace at app.powerbi.com, select Manage access at the top of the content list, then + Add people or groups, type a name, an email, or a security group, pick the role and press Add. Only Admins and Members see Manage access. Whoever creates a workspace becomes its first Admin. Creating one needs Pro or Premium Per User: Workspaces → + New workspace.

The four roles, from weakest to strongest

Role	Can do (on top of the role above)
Viewer	View and interact with reports and dashboards: filter, slice, drill, export where allowed. Row-level security applies.
Contributor	Create, edit and delete content; publish reports from Desktop into the workspace; schedule refresh. Updates the app only if an Admin allows it.
Member	Add people as Member, Contributor or Viewer; share items and let others reshare; publish, update and unpublish the workspace’s app.
Admin	Add and remove anyone, including other Admins; change workspace settings; delete the workspace.

Every role above Viewer can also see all of the data: security rules written for readers don’t apply to people who can edit the model. That matters in the RLS levels later in this chapter.

Least privilege

Pick the weakest role that still does the job. Store managers who read the reports are Viewers, or better, they don’t belong in the workspace at all and get the app instead (next level). Analysts who build are Contributors. One or two leads who decide who gets in are Members. Keep Admins to two people, so the workspace never ends up without one when someone leaves.

Groups, not people

You can add individuals, Microsoft 365 groups, security groups or distribution lists. A group named Sales Analysts with the Contributor role means a new hire is added to the group once (often by IT) and every workspace that uses the group follows. Removing a leaver works the same way.

Common mistakes

• Member for everyone. Members can invite others and republish the app.
• Readers as Contributors. They can delete the report they were only meant to read.
• One Admin. When that person leaves, nobody can manage the workspace without a tenant admin.
• Expecting RLS to hide data from builders. It only filters Viewers.