Updating warehouse tables requires at least the Contributor workspace role because Write is not shareable to a Viewer

Configure security and governance

Answer Correct answer: D — Warehouse Write is not shareable to a Viewer, so only Contributor or higher can update tables; object-level permissions alone cannot grant a Viewer write.

You have a Fabric workspace named Workspace1 that contains a warehouse named DW1 and a data pipeline named Pipeline1. You plan to add a user named User3 to Workspace1. You need to ensure that User3 can perform the following actions: View all the items in Workspace1. Update the tables in DW1. The solution must follow the principle of least privilege. You already assigned the appropriate object-level permissions to DW1. Which workspace role should you assign to User3?

Admin
Member
Viewer
Contributor Correct Answer

fabric workspace contributor warehouse write fabric warehouse write permission not shareable viewer fabric warehouse item permissions

Community Votes

48%

28%

24%

48% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

In Fabric warehouses the Write permission is 'Shareable: No', meaning a workspace Viewer can never be granted the ability to update warehouse data regardless of item-level permissions; the workspace role must be at least Contributor.

To let a user both view all workspace items and update tables in a Fabric warehouse, assign the Contributor workspace role. The warehouse Write permission is granted by default only to Admin, Member, and Contributor and is not shareable to a Viewer, so item-level permissions alone cannot grant a Viewer write access.

Assuming that assigning object-level permissions on the warehouse lets a Viewer update tables; the Write permission cannot be granted to a Viewer, so the workspace role must be Contributor.

Community Discussion (13 comments)

Bovote 👍 8 Selected: D

Viewer - Can view all content in the workspace, but can't modify it. Contributor - Can view and modify all content in the workspace. Member - Can view, modify, and share all content in the workspace. Can add Members Admin - Can view, modify, share, and manage all content in the workspace, including managing permissions. - Can add Admins, Members and can delete workspace. So Contributor is the least role who can view and update the tables (modify the content).

01ceacf 👍 7 Selected: B

Only member or above can modify warehouse items https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces

d98a23f 👍 1 Selected: D

contibutor have read/write access to a warehouse:https://learn.microsoft.com/en-us/fabric/data-warehouse/share-warehouse-manage-permissions

Adriel_1996 👍 2 Selected: C

If DW (which need modify permission) already has assigned the right permission only with viewer the User3 could view all items

vish9 👍 2 Selected: C

Assign the Viewer role to User3 to allow viewing all workspace items. Object-level permissions already cover updates to DW1, ensuring least privilege is maintained.

GadAugust 👍 2 Selected: C

This is a really tricky question and the answer does not just lay in the coarse grained workspace roles https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces The user should be able to view the items in the workspace - VIEWER The user can already update the tables in the DW1 database through object-level permissions So if you apply the Principle of Least privilege, VIEWER is all that is required. All other roles will elevate the user privilege over and above the requirements.

Goye 👍 1 Selected: B

member can create or modify warehouse items according to doc, contributors can’t https://learn.microsoft.com/en-us/fabric/fundamentals/roles-workspaces#-workspace-roles

benni_ale 👍 1 Selected: C

you could assign viewer role in the workspace which won't overwrite the the appropriate-already-configured object-level permission on dw1 so the user will be able to view all objects in ws1 but will also be able to run update statements within the dw1

prabhjot 👍 1 Selected: D

Contributor fits the best as being a member would grant the user the power to add other users to the workspace, thus defeating the whole purpose of the question - "Least Privileged Access"

18e18d0 👍 1 Selected: D

It is not specified that the user should be able to add other users to Workspace. Contributors can modify data, but not add others to Workspace. According to the documentation - Contributor is the least privileged role: https://learn.microsoft.com/en-us/fabric/security/permission-model#workspace-roles

Bovote 👍 1

Viewer Can view all content in the workspace, but can't modify it. Contributor Can view and "modify" all content in the workspace. Member Can view, modify, and share all content in the workspace. Can add Members Admin Can view, modify, share, and manage all content in the workspace, including managing permissions. - Can add Admins, Members and can delete workspace. So Contributor is the least role who can view and update the tables (modify the content).

4371883 👍 1 Selected: D

Contributor is the least privilege role according to this. https://learn.microsoft.com/en-us/fabric/security/permission-model

gfors 👍 2 Selected: D

This is wrong in the docs. Read this https://community.fabric.microsoft.com/t5/Service/Create-or-modify-warehouse-items-can-do-with-Contributor-role/m-p/4318708

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Microsoft Fabric workspace roles grant 'Write or delete... data warehouses' only to Admin, Member, and Contributor, not to Viewer. The warehouse item-permission table further shows that the Write permission is given by default to Admin, Member, and Contributor and is marked 'Shareable: No', meaning you cannot grant Write to a Viewer through item sharing. Therefore, even though the scenario says appropriate object-level permissions were assigned, a Viewer still cannot update tables, and the least-privilege workspace role that includes Write is Contributor.

Why the Other Options Are Wrong

Option A (Admin) and B (Member) also have Write but exceed least privilege (Admin/Member can manage membership and settings). Option C (Viewer) cannot write to a warehouse because Write is not shareable to Viewers, so it fails the 'update tables' requirement despite object-level permissions.

Community Comment Notes

The community was split (D 48, C 24, B 28). Several comments (Bovote, 01ceacf) note that only Member or above can modify warehouse items, and the warehouse permission doc confirms Write is not shareable to a Viewer, supporting Contributor as the least-privilege answer.

Official Reference

https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces

Related Analysis

← Back to DP-700 Study Guide