Updating warehouse tables requires at least the Contributor workspace role because Write is not shareable to a Viewer

DP-700 By islever Editorial Last updated

Configure security and governance

Short answer

D Warehouse Write is not shareable to a Viewer, so only Contributor or higher can update tables; object-level permissions alone cannot grant a Viewer write.

Question

You have a Fabric workspace named Workspace1 that contains a warehouse named DW1 and a data pipeline named Pipeline1. You plan to add a user named User3 to Workspace1. You need to ensure that User3 can perform the following actions: View all the items in Workspace1. Update the tables in DW1. The solution must follow the principle of least privilege. You already assigned the appropriate object-level permissions to DW1. Which workspace role should you assign to User3?
  1. Admin
  2. Member
  3. Viewer
  4. Contributor Correct Answer

Key Takeaways

In Fabric warehouses the Write permission is 'Shareable: No', meaning a workspace Viewer can never be granted the ability to update warehouse data regardless of item-level permissions; the workspace role must be at least Contributor.

To let a user both view all workspace items and update tables in a Fabric warehouse, assign the Contributor workspace role. The warehouse Write permission is granted by default only to Admin, Member, and Contributor and is not shareable to a Viewer, so item-level permissions alone cannot grant a Viewer write access.

Common mistake: Assuming that assigning object-level permissions on the warehouse lets a Viewer update tables; the Write permission cannot be granted to a Viewer, so the workspace role must be Contributor.

Expert Analysis

Why the Answer Is Correct

Microsoft Fabric workspace roles grant 'Write or delete... data warehouses' only to Admin, Member, and Contributor, not to Viewer. The warehouse item-permission table further shows that the Write permission is given by default to Admin, Member, and Contributor and is marked 'Shareable: No', meaning you cannot grant Write to a Viewer through item sharing. Therefore, even though the scenario says appropriate object-level permissions were assigned, a Viewer still cannot update tables, and the least-privilege workspace role that includes Write is Contributor.

Why the Other Options Are Wrong

Option A (Admin) and B (Member) also have Write but exceed least privilege (Admin/Member can manage membership and settings). Option C (Viewer) cannot write to a warehouse because Write is not shareable to Viewers, so it fails the 'update tables' requirement despite object-level permissions.

Community Comment Notes

The community was split (D 48, C 24, B 28). Several comments (Bovote, 01ceacf) note that only Member or above can modify warehouse items, and the warehouse permission doc confirms Write is not shareable to a Viewer, supporting Contributor as the least-privilege answer.

Official Reference

https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces

This link opens the official vendor documentation in a new tab.

Community Votes

D
48%
B
28%
C
24%

48% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Bovote 👍 8 Answered D
    Viewer - Can view all content in the workspace, but can't modify it. Contributor - Can view and modify all content in the workspace. Member - Can view, modify, and share all content in the workspace. Can add Members Admin - Can view, modify, share, and manage all content in the workspace, including managing permissions. - Can add Admins, Members and can delete workspace. So Contributor is the least role who can view and update the tables (modify the content).
  2. 01ceacf 👍 7 Answered B
    Only member or above can modify warehouse items https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces
  3. GadAugust 👍 2 Answered C
    This is a really tricky question and the answer does not just lay in the coarse grained workspace roles https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces The user should be able to view the items in the workspace - VIEWER The user can already update the tables in the DW1 database through object-level permissions So if you apply the Principle of Least privilege, VIEWER is all that is required. All other roles will elevate the user privilege over and above the requirements.
  4. vish9 👍 2 Answered C
    Assign the Viewer role to User3 to allow viewing all workspace items. Object-level permissions already cover updates to DW1, ensuring least privilege is maintained.
  5. gfors 👍 2 Answered D
    This is wrong in the docs. Read this https://community.fabric.microsoft.com/t5/Service/Create-or-modify-warehouse-items-can-do-with-Contributor-role/m-p/4318708
Show 8 more comments
  1. Adriel_1996 👍 2 Answered C
    If DW (which need modify permission) already has assigned the right permission only with viewer the User3 could view all items
  2. Bovote 👍 1
    Viewer Can view all content in the workspace, but can't modify it. Contributor Can view and "modify" all content in the workspace. Member Can view, modify, and share all content in the workspace. Can add Members Admin Can view, modify, share, and manage all content in the workspace, including managing permissions. - Can add Admins, Members and can delete workspace. So Contributor is the least role who can view and update the tables (modify the content).
  3. 18e18d0 👍 1 Answered D
    It is not specified that the user should be able to add other users to Workspace. Contributors can modify data, but not add others to Workspace. According to the documentation - Contributor is the least privileged role: https://learn.microsoft.com/en-us/fabric/security/permission-model#workspace-roles
  4. benni_ale 👍 1 Answered C
    you could assign viewer role in the workspace which won't overwrite the the appropriate-already-configured object-level permission on dw1 so the user will be able to view all objects in ws1 but will also be able to run update statements within the dw1
  5. prabhjot 👍 1 Answered D
    Contributor fits the best as being a member would grant the user the power to add other users to the workspace, thus defeating the whole purpose of the question - "Least Privileged Access"
  6. Goye 👍 1 Answered B
    member can create or modify warehouse items according to doc, contributors can’t https://learn.microsoft.com/en-us/fabric/fundamentals/roles-workspaces#-workspace-roles
  7. d98a23f 👍 1 Answered D
    contibutor have read/write access to a warehouse:https://learn.microsoft.com/en-us/fabric/data-warehouse/share-warehouse-manage-permissions
  8. 4371883 👍 1 Answered D
    Contributor is the least privilege role according to this. https://learn.microsoft.com/en-us/fabric/security/permission-model

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

A 500-million-row fact table exceeds the F32 Direct Lake guardrail, so increase the capacity to F64

S-grade

Shortcut caching supports only S3/GCS shortcuts and excludes files larger than 1 GB

S-grade

Run T-SQL in a KQL database only by prefixing the query with a -- comment line

S-grade

Store semi-structured data readable by T-SQL, KQL, and Spark in an eventhouse

S-grade

← Back to DP-700 Study Guide