Roles in workspaces in Power BI
Workspaces are places to collaborate with colleagues and create collections of dashboards, reports, datasets, and paginated reports. This article describes the different roles in workspaces, and what people in each role can do. For more information, see workspaces in Power BI.
To create a new workspace, see Create a workspace.
Roles let you manage who can do what in a workspace, so teams can collaborate. Workspaces allow you to assign roles to individuals, and also to user groups such as security groups, Microsoft 365 groups, and distribution lists.
To grant access to a workspace, assign one of the following workspace roles to a user group or individuals: Admin, Member, Contributor, or Viewer. For more information, see Give users access to workspaces.
Everyone in a user group gets the role that you've assigned. If someone is in several user groups, they get the highest level of permission that's provided by the roles that they're assigned. If you nest user groups and assign a role to a group, all the contained users get that role's permissions. All these capabilities, except viewing and interacting, require a Power BI Pro or Premium Per User (PPU) license. For more information, see licensing.
Workspace roles
| Capability | Admin | Member | Contributor | Viewer |
|---|---|---|---|---|
| Update and delete the workspace. | 
|
|||
| Add or remove people, including other admins. |
|
|||
| Allow Contributors to update the app for the workspace. |
|
|||
| Add members or others with lower permissions. |
|
|
||
| Publish, unpublish, and change permissions for an app. |
|
|
||
| Update an app. |
|
|
If allowed 1 | |
| Share an item or share an app.2 |
|
|
||
| Allow others to reshare items.2 |
|
|
||
| Feature apps on colleagues' home. |
|
|
||
| Manage dataset permissions.3 |
|
|
||
| Feature dashboards and reports on colleagues' home. |
|
|
|
|
| Create, edit, and delete content, such as reports, in the workspace. |
|
|
|
|
| Publish reports to the workspace, and delete content. |
|
|
|
|
| Create a report in another workspace based on a dataset in this workspace.3 |
|
|
|
|
| Copy a report.3 |
|
|
|
|
| Create metrics that's based on a dataset in the workspace.3 |
|
|
|
|
| Schedule data refreshes via the on-premises gateway.4 |
|
|
|
|
| Modify gateway connection settings.4 |
|
|
|
|
| View and interact with an item.5 |
|
|
|
|
| Read data that's stored in workspace dataflows. |
|
|
|
|
1 Contributors can update the app that's associated with the workspace, if the workspace Admin delegates this permission to them. However, they can't publish a new app or change who has permission to edit it.
2 Contributors and Viewers can also share items in a workspace, if they have Reshare permissions.
3 To copy a report to another workspace, and to create a report in another workspace based on a dataset in the current workspace, you need Build permission for the dataset. You also need at least the Contributor role on the source and destination workspaces. For datasets in the original workspace, if you have at least the Contributor role, you automatically have Build permission through your workspace role. For details, see Copy reports from other workspaces.
4 Keep in mind that you also need permissions on the gateway. Those permissions are managed elsewhere, independent of workspace roles and permissions. For details, see Manage an on-premises gateway.
5 If the items are in a workspace in a Premium capacity, you can view and interact with items in the Power BI service even if you don't have a Power BI Pro license.
Note
- You can assign users to roles, either alone or in a group, even if they can't use the role. In other words, you can assign users who don't have Power BI Pro or PPU licenses to a role that requires a license. See Licenses for details.
- Use the Viewer role to enforce row-level security (RLS) for users who browse content in a workspace. You can also enforce RLS without giving access to the workspace, publish an app and distribute it to those users, or use sharing to distribute content.
- Members can add users to a workspace with lower permissions, but can't remove users from any workspace roles.
Licenses
If one of the workspaces is in a shared capacity, everyone you add to it needs a Power BI Pro or Premium Per User (PPU) license. These users can all collaborate on the dashboards and reports in the workspace. If you want to distribute content to others inside your organization, either assign Power BI Pro licenses to those users or place the workspace in a Power BI Premium capacity.
When the workspace is in a Power BI Premium capacity, users with the Viewer role can access the workspace even if they don't have a Power BI Pro or Premium Per User (PPU) license. However, if you assign these users a higher role like Admin, Member, or Contributor, they're prompted to start a Pro trial when they try to access the workspace. If you want users without Pro or Premium Per User (PPU) licenses to use the Viewer role, make sure they don't also have other workspace roles, either as individuals or as part of a user group.
Publishing reports to the workspace enforces existing licensing rules. If you try to publish from Power BI Desktop or other client tools without a Pro or Premium Per User (PPU) license, you see the error, "Only users with Power BI Pro licenses can publish to this workspace."
Note
Power BI US Government isn't available as a Free license. For licensing details, see Power BI for US government customers.
Guest users
By default, Azure AD B2B Guest users can't access workspaces. Power BI admins can allow external guest users to edit and manage content in the organization. Enabled Guest users can access workspaces to which they have permission.
Considerations and limitations
A limitation to be aware of:
- A person with a Power BI Pro license can be a member of a maximum of 1,000 workspaces.
Next steps
Feedback
Submit and view feedback for