Power BI Fabric Deployment Pipeline Permissions
Answer
Correct answer: B, D, E — Assign Admin access to the deployment pipeline to manage deployments, Contributor access to Development and Test workspaces to allow item creation and deployment, and Viewer access to the Production workspace to prevent changes.
You plan to deploy Microsoft Power BI items by using Fabric deployment pipelines. You have a deployment pipeline that contains three stages named Development, Test, and Production. A workspace is assigned to each stage. You need to provide Power BI developers with access to the pipeline. The solution must meet the following requirements: Ensure that the developers can deploy items to the workspaces for Development and Test. Prevent the developers from deploying items to the workspace for Production. Follow the principle of least privilege. Which three levels of access should you assign to the developers? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.
power bi fabric deployment pipeline permissions
dp-600 deployment pipeline questions
power bi workspace contributor vs viewer
fabric cicd least privilege
Community Votes
100% of anonymous learners picked answer BDE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the specific permission model for Fabric deployment pipelines, where pipeline Admin rights are required to trigger deployments, but workspace-level permissions (Contributor vs. Viewer) control what can actually be changed in each stage.
To allow developers to deploy items via Fabric deployment pipelines while restricting production changes, you must assign Admin access to the pipeline, Contributor access to Development and Test workspaces, and Viewer access to the Production workspace.
Many candidates incorrectly choose Member or Build permissions because they confuse standard workspace roles with the specific requirements of the deployment pipeline workflow, or they fail to realize that Pipeline Admin is a distinct role from Workspace Admin.
Community Discussion (23 comments)
sraakesh95
👍 24
Selected: BDE
As pointed out by XiltroX, B - Admin access is provided to the developers for the developers to manage the deployent process across the various stages (in this case Dev and Test). This is a basic necessary. D - To restrict the access on the Production workspace, provide an overriding Viewer access which lets the developers only view the Production environment and not make any changes. E - This is to provide the developers with the permissions to develop, edit and update the Dev and Test pipelines.
elma_qhor_19
👍 1
Selected: BDE
B - Admin access is provided to the developers for the developers to manage the deployent process across the various stages (in this case Dev and Test). This is a basic necessary. D - To restrict the access on the Production workspace, provide an overriding Viewer access which lets the developers only view the Production environment and not make any changes. E - This is to provide the developers with the permissions to develop, edit and update the Dev and Test pipelines.
NRezgui
👍 1
Selected: BDE
B - Admin access is provided to the developers for the developers to manage the deployent process across the various stages (in this case Dev and Test). This is a basic necessary. D - To restrict the access on the Production workspace, provide an overriding Viewer access which lets the developers only view the Production environment and not make any changes. E - This is to provide the developers with the permissions to develop, edit and update the Dev and Test pipelines.
Rakesh16
👍 1
Selected: BDE
BAdmin access to the deployment pipeline DViewer access to the Production workspace EContributor access to the Development and Test workspaces
KipngenohVinnie
👍 1
To meet the requirements while following the principle of least privilege, you should assign the following levels of access to the developers: B. Admin access to the deployment pipeline - This is needed so developers can manage the deployment pipeline itself, including moving items between stages. E. Contributor access to the Development and Test workspaces - This allows developers to deploy and make changes to the items in the Development and Test workspaces. D. Viewer access to the Production workspace - This ensures developers can view the Production workspace but cannot make any changes or deploy items to it.
user12345678
👍 1
Selected: BDE
B - There's only one role for pipelines so it's either having an Admin role or no access to a pipeline. You have to have an Admin role on a pipeline in order to do any deployments. D - Pipeline permissions and workspace permissions are kind of linked but the way it works is if a user has viewer permissions on a workspace and Admin on the Pipeline - They won't be able to do a deployment to that workspace, but they can still see things inside of it (as is the case as a viewer in any workspace). E - If you have the Contributer/Member/Admin role on a workspace AND Admin permissions on a pipeline, then you can deploy to that workspace.
bad4b76
👍 1
It does not say Developers need to manage deployments, just access items within the pipeline. So A, D, and E
Ahmadpbi
👍 1
A D E because: In Power BI, having Viewer access to a workspace does not automatically grant Build permission for a semantic model within that workspace. The Viewer role allows a user to view and interact with items in the workspace, but it does not include the ability to create new content or edit existing content. To have Build permission, a user must be explicitly granted that permission, which allows them to build new content from the semantic model, access reports that use composite models on Power BI Pro workspaces, and pull data into Analyze in Excel, among other capabilities. This permission can be given by the workspace Admin or Member who has the authority to manage semantic model permissions
bmc15
👍 1
Selected: BDE
B: It's admin or nothing for pipeline access. D: Viewer, so they cannot create it in production. E: You need Contributor on the workspaces you want to deploy and create.
SilvanoRamalho
👍 1
Selected: BDE
Respostas BDE
Jons123son
👍 1
Was in exam. Scored 95% Chose BDE Answers swtichted Contributor for Member role
Gerald
👍 1
I agree with BDE
282b85d
👍 2
E. Contributor access to the Development and Test workspaces: This allows developers to deploy and manage content in the Development and Test workspaces, meeting the requirement to allow deployments in these stages. D. Viewer access to the Production workspace: This provides developers with read-only access to the Production workspace, ensuring they can view content but cannot deploy or make changes, which aligns with the requirement to prevent deployments to Production. B. Admin access to the deployment pipeline: This allows developers to manage the deployment pipeline itself, including deploying items to the Development and Test stages but not to the Production stage. This ensures they can oversee the deployment process without overstepping into the Production environment.
David_Webb
👍 2
Selected: BDE
Admin access is needed in the development workspace for pipeline.
72bd3bc
👍 1
To deploy from one stage to another in the pipeline, you must be a pipeline admin, and either a member or an admin of the workspaces assigned to the stages involved. For example, a pipeline admin that isn't assigned a workspace role, can view the pipeline and share it with others. However, this user can't view the content of the workspace in the pipeline, or in the service, and can't perform deployments. https://learn.microsoft.com/en-us/fabric/cicd/deployment-pipelines/understand-the-deployment-process#permissions/?azure-portal=true From task: Prevent the developers from deploying to the production. So B is not correct, we can't give pipeline admin access?
stilferx
👍 2
Selected: BDE
IMHO, B->D->E B. Admin access to the deployment pipeline - to be able to run D. Viewer access to the Production workspace - to not be able to run Prod E. Contributor access to the Development and Test workspaces - to be able to run Dev/Test
PazaBIandData
👍 2
Selected: BD
Member or Admin rights on the workspace level are required to deploy datasets so E doesn't match the requirements. https://learn.microsoft.com/en-us/fabric/cicd/deployment-pipelines/understand-the-deployment-process#permissions-table
Nefirs
👍 2
Selected: BDE
my reasoning: A: nope since they should not be able to build things there B: not sure C: nope since this would prevent them from deploying stuff there D: yes because of least privilege E: yes so they can build/deploy stuff there F: nope. Too much permissions. --> so this leaves option B as the third answer.
a_51
👍 1
Selected: BDE
I think it is B,D,E, but the admin title throws you off as it can deploy items and is a key to what it asks. Build permission allows to create new content in the workspace, so not sure that is right, answer A. https://learn.microsoft.com/en-us/fabric/cicd/deployment-pipelines/understand-the-deployment-process?WT.mc_id=access_pane#permissions
thuss
👍 3
Selected: BDE
I get a feeling the "trick" is making you think that B would allow publishing on Prod, but I think if you don't give them access to the workspace, they can indeed have admin rights on the build pipeline but not deploy on Prod? So BDE would be my guess. Also B is the only option granting access to the pipeline at all, and D and E are a must.
XiltroX
👍 4
Selected: BDE
I think the answer should be BDE. If you have contributer access to the workspace, then you don't need to assign an additional viewer access (C) to the developers. One of the requirements is to grant access to the pipeline and the only option that fulfills that is (B). D and E fulfill the rest of the requirements in the question.
estrelle2008
👍 4
Selected: CDE
I think build permission to the production semantic model, conflicts with requirement that any changes to the Production workspace should be prevented. If question really requires 3 answers, I think both Viewer access (C) and Contributor access (E) can coexist effectively for the Development and Test workspaces.
Momoanwar
👍 2
Selected: ADE
I think its correct if developper can read data on production. Dont need b and c with E F is too high
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B, D, and E. To manage a deployment pipeline, a user requires Admin access to the pipeline itself (Option B), which allows them to view the pipeline configuration and initiate deployments. For the source stages (Development and Test), developers need Contributor access (Option E) to the workspaces so they can create, modify, and deploy items. To prevent accidental changes to the Production environment while still allowing developers to see what is deployed, Viewer access (Option D) is assigned to the Production workspace, adhering to the principle of least privilege.Why the Other Options Are Wrong
Option A (Build permission to production semantic models) is incorrect because it would allow developers to rebuild or change data models in Production, violating the requirement to prevent deployment to Production. Option C (Viewer access to Dev/Test) is insufficient because Viewers cannot deploy items; they can only read content. Therefore, C contradicts the requirement to allow deployment in Dev/Test. Option F (not listed but often considered as Member) is too broad if not paired correctly, but specifically, Member access to Prod would also violate the restriction.Community Comment Notes
The community consensus strongly favors BDE. As noted by user XiltroX, Contributor access inherently allows deployment, making Viewer access redundant for Dev/Test. User sraakesh95 highlights that Admin access to the pipeline is necessary to manage the process across stages. Some users like PazaBIandData initially questioned if Contributor was sufficient without Pipeline Admin, but official documentation confirms that Pipeline Admin is required to run the deployment steps.Official Reference
Exam Strategy
When dealing with deployment pipelines, always remember that 'Pipeline Admin' is a separate permission layer from 'Workspace Roles'. You need Pipeline Admin to orchestrate the move, but Workspace roles determine what happens at the destination. Use Contributor for staging environments where changes are expected, and Viewer for production to enforce strict read-only access.
Frequently Asked Questions
Why is Admin access to the pipeline required?
Admin access to the pipeline allows users to view pipeline settings and initiate deployment steps. Without this, even Contributor access to workspaces won't allow triggering the pipeline flow.
Can I use Member access instead of Contributor for Dev/Test?
While Member access includes Contributor capabilities, the exam options specify Contributor. Contributor is the precise role needed for deploying items. Using Member might imply additional management rights not strictly required for just deploying items.
Related Analysis
Practice All DP-600 Questions
Access 115 questions with complete answers and detailed explanations.
View Full DP-600 Practice Test →