Fabric workspace roles: Viewer vs Contributor vs Member vs Admin
Verdict: Contributor is the minimum role that creates and writes items, including Eventhouse and KQL schema. Member adds default resharing and onboarding of lower roles. Only Admin deletes the workspace or adds other admins. Viewer only reads.
| Criterion | Viewer | Contributor | Member | Admin |
|---|---|---|---|---|
| Read content | Yes | Yes | Yes | Yes |
| Create, modify items and write data | No | Yes | Yes | Yes |
| Write Eventhouse or KQL schema | No | Yes | Yes | Yes |
| Reshare items by default | No, needs per-item grant | No, needs per-item grant | Yes | Yes |
| Add members | No | No | Yes, lower-privileged roles | Yes, including admins |
| Delete workspace | No | No | No | Yes |
| Choose when | Read-only consumers | Engineers building items; CI/CD service principals | Delegate resharing and onboarding without full control | Full control incl. deletion and admin grants |
Rules
- Contributor is the minimum role for notebook CRUD via the Fabric Items REST API; a workspace-assigned service principal inherits the same permissions as a user.
- Contributor is the minimum role to write or delete Eventhouse schema and KQL database data.
- A Viewer or Contributor can reshare a specific item only when granted per-item Reshare permission; Member can reshare all content by default.
- Member can add members and lower-privileged users by default but cannot delete the workspace or add admins.
- Removing item-level sharing does not revoke access if the user still holds a workspace role such as Viewer.
Traps
- Contributor cannot manage workspace membership; adding users requires Member or Admin.
- Reshare permission on one item does not let a Viewer delete the workspace, certify items, or add members.
- Service principals must still hold a workspace role; an Entra app registration alone grants no API access.