Which workspace role meets least privilege for viewing items and updating DW1?
Configure security and governance
Configure Microsoft Fabric workspace settings
Answer
Correct answer: C — Assign the Viewer workspace role so User3 can view all Workspace1 items, while existing object-level DW1 permissions handle table updates with least privilege.
You have a Fabric workspace named Workspace1 that contains a warehouse named DW1 and a data pipeline named Pipeline1. You plan to add a user named User3 to Workspace1. You need to ensure that User3 can perform the following actions: View all the items in Workspace1. Update the tables in DW1. The solution must follow the principle of least privilege. You already assigned the appropriate object-level permissions to DW1. Which workspace role should you assign to User3?
Community Insight
This question tests separating Fabric workspace roles from object-level warehouse permissions; the trap is assuming Contributor is required to update DW1 tables.
Fabric workspace roles control item visibility, while warehouse object-level permissions grant T-SQL access. This page explains why Viewer is the least-privilege role for User3 when DW1 permissions are already assigned.
Choosing Contributor because it can edit warehouse data, overlooking that object-level permissions already grant DW1 updates and Contributor would also allow editing Pipeline1.
Community Discussion (56 comments)
gpasini
👍 1
Selected: C
Copilot said: The correct answer is Viewer. ✅ Reasoning: The requirement is that User3 can view all items in Workspace1. User3 must also be able to update tables in DW1. The question explicitly states that you already assigned the appropriate object-level permissions to DW1. In Fabric, a Viewer workspace role can: See all items in the workspace. Connect to and read warehouse content. Not modify workspace items. Since the necessary object-level permissions on the warehouse have already been granted, User3 can perform the required table updates through those SQL permissions without needing elevated workspace permissions. Assigning Contributor, Member, or Admin would also work, but they would grant unnecessary permissions (such as modifying workspace items, pipelines, warehouses, etc.), violating the principle of least privilege.
c41d525
👍 1
Selected: D
Viewer Can view workspace items but cannot modify them.
Ce____
👍 2
Selected: D
D Remains the answer, a viewer can't modify the contents of a workspace, just to view, a most acceptable with least privilege is Contributor
alinavit
👍 2
Selected: C
It states: "You already assigned the appropriate object-level permissions to DW1." So it is enough to select viewer role Verified in Fabric
90fb958
👍 1
Selected: C
“You already assigned the appropriate object-level permissions to DW1” is key. Appropriate Object level permission could allow to UPDATE existing tables (create is not required in this scenario). Thus leaving answer: viewer
95704b2
👍 3
Selected: C
C is the correct answer based on principle of least privilege Viewer can view all the content of the Workspace and since you already assigned the appropriate object-level permissions to DW1
montoya207
👍 3
Selected: C
The correct answer is C. Viewer. Here is the technical justification based on the sources: Viewing items: The Viewer role allows the user to view all items in the workspace (Workspace1), fulfilling the first requirement. Updating data: In Fabric, T-SQL permissions (such as UPDATE or INSERT) are managed at the database engine level. If you have already assigned the appropriate object-level permissions, the user only needs “Read” access to the Warehouse element to connect to its SQL connection point. The Viewer role grants this basic access.
luckybalaji
👍 4
Selected: C
Viewer only gives the least privilege, giving contributor role makes permission to amend pipeline1 it is note required as per question.
Iconsulting
👍 3
Selected: C
If you assign the Contributor role to User3, they can also modify Pipeline1, thus violating the principle of least privilege, which is a requirement.
Soteras
👍 1
Selected: C
❌ Por que Colaborador NÃO é a resposta correta O usuário não precisa criar nem modificar itens do workspace Já possui permissões no nível do warehouse A role Colaborador concede privilégios adicionais desnecessários Portanto, viola o princípio do menor privilégio
aws123
👍 2
Selected: C
"You already assigned the appropriate object-level permissions to DW1" so viewer is the best answer with least privileges
MedMed009
👍 1
Selected: B
Requirement: User3 must view all items in Workspace1 and update tables in DW1. Object‑level permissions for DW1 are already granted. -Viewer → too restrictive (view only). -Contributor → can edit, but does not guarantee visibility of all items. -Admin → excessive privilege. -Member → correct fit: can view all items and update DW1 tables. So the answer is B Link : https://learn.microsoft.com/en-us/fabric/fundamentals/roles-workspaces
e0f0ce6
👍 2
Selected: C
"You already assigned the appropriate object-level permissions to DW1." This ensures the ability to read write in the DW. For the rest Viewer is enough.
Mustafa_Shazly
👍 1
Selected: D
Update any item begin from Contributor role anything else viewer or sharing will read only object-level permissions restrict access object to some users Even if viewer or Contributor
emboutchamani
👍 2
Selected: C
In Microsoft Fabric, the Viewer role provides "Read" permissions on the Warehouse item, which allows the user to connect to the Warehouse via the SQL endpoint. The actual ability to modify data (INSERT/UPDATE/DELETE) or schema (DDL) is controlled by SQL object-level permissions inside the Warehouse. Since the prompt states you have "already assigned the appropriate object-level permissions to DW1" (e.g., GRANT UPDATE, db_datawriter), the User only needs the connectivity provided by the Viewer role to utilize those SQL permissions.
emboutchamani
👍 1
Selected: D
the minimum right to modify content is contributor
eoicp
👍 1
Selected: C
The Object level permissions have already been set in the DW1, meaning user3 can already access and modify tables without even being added to the workspace. The text says he needs view permissions on the workspace. Due to the principle of least privilige the answwer should be C. Viewer.
Anchalgupta
👍 1
Selected: C
It satisfies both requirements while following the principle of least privilege
a74cb2b
👍 3
Selected: C
"You already assigned the appropriate object-level permissions to DW1." => this overwrites the general workspace level restrictions on Viewer, allowing User3 to update the the tables in DW1. Admin, Member, and Contributor all grant Control access to warehouses, while Viewer grants Connect and ReadData permissions. When combined with object-level SQL permissions, Viewer satisfies the requirements while following least privilege.
9a69b12
👍 2
Selected: C
"You already assigned the appropriate object-level permissions to DW1." meaning that the user, if granted VIEW, has all necessary permissions.
larinate
👍 1
Selected: B
Only Member or Admin can modify shared workspace items such as warehouses. Contributor is limited to their own items. Admin is too much, so Member -> B
rc012345
👍 2
Selected: C
Viewer access at workspace level. In the warehouse (OLS) - sql query: Granted UPDATE, INSERT access on table level to "user-email" Result: User able to update (insert) values to respective table.
Bin_Hashim
👍 2
Selected: C
According to these words from Question "You already assigned the appropriate object-level permissions to DW1." (this seems tricky part of the question) C. Viewer
ShazzyHawk
👍 4
Selected: C
“You already assigned the appropriate object-level permissions to DW1” changes everything. Object-level permissions on DW1 override workspace-level edit restrictions. A Viewer role on the workspace allows the user to see all workspace items, while the object-level permissions on DW1 allow them to update data in the warehouse. Therefore, granting Contributor or higher would violate least privilege, since those roles allow editing other workspace items.
wellingtonluis
👍 2
Selected: C
The Key phrase here is: "You already assigned the appropriate object-level permissions to DW1". So Viewer in Workspace is enought.
fdsdfgxcvbdsfhshfg
👍 2
Selected: D
You would think that SQL Granular Permissions would work even for a viewer workspace role, like in the case of Synpase I believe, but here Fabric won't allow an UPDATE statement for a viewer.
e71e79b
👍 2
Selected: D
A Contributor can view all items in a Fabric workspace and interact with specific objects—like updating tables—as long as they already have object-level permissions. Since you’ve already given User3 the necessary object-level permissions on DW1, this role grants just enough access without overstepping boundaries. Perfect alignment with the principle of least privilege.
alex_sql
👍 1
Selected: D
Contributor es el mínimo rol que permite ver y modificar (si ya tiene los permisos necesarios a nivel de objeto)
Acrious
👍 1
Selected: D
It is not clear, that they actually were given the Object level permissions at the Workspace level, again another unclear detail in the question imho. So I am going to go with contributor.
smanzana
👍 1
Selected: D
D is correct
DarioReymago
👍 1
Selected: C
View all the items in Workspace1. Update the tables in DW1. You already assigned the appropriate object-level permissions to DW1. Contributor Can view and modify all content in the workspace. So it is higer option] Viewer + object-level is enough
alex_sql
👍 2
Viewer + permisos a nivel objeto: solo puede consultar, no puede modificar.
Jay63002
👍 2
Selected: D
as per this doc, contributor can create and modify warehouse item : https://learn.microsoft.com/en-us/fabric/fundamentals/roles-workspaces
PBridge
👍 3
Selected: D
Explanation: You need to ensure that User3 can: View all items in the workspace Update tables in DW1 Follow the principle of least privilege Roles breakdown: Admin: Too much access (can delete, manage roles, settings, etc.) Member: Also more permissions than needed (can publish and manage content broadly) Viewer: Read-only — cannot update DW1 ✅ Contributor: Can view all items Can edit datasets, dataflows, pipelines, and warehouses (if object-level permissions are granted) Fits the least privilege principle
Sr18
👍 1
Selected: D
Contributor role
eoicp
👍 1
I think you don't need any access to the workspace. Connection string and SSMS is enough, if r/w access is granted in the DW.
5dcd3a8
👍 2
Selected: D
The Viewer role allows a user to: See all items in the workspace Cannot open notebooks or pipelines Cannot run queries or update data, even if object-level permissions are granted Viewer role is strictly read-only at the workspace level, regardless of object-level permissions. Why Contributor is correct: Can view all items in the workspace Can interact with items (like run pipelines, notebooks) With object-level permissions, can update data in DW1 Does not have management privileges (unlike Member or Admin) Contributor + object-level permissions = just enough rights to view and update without overreaching — perfect for least privilege.
ts_au
👍 2
Selected: C
they already have access to DW1
d98a23f
👍 1
Selected: D
contibutor have read/write access to a warehouse:https://learn.microsoft.com/en-us/fabric/data-warehouse/share-warehouse-manage-permissions
Adriel_1996
👍 3
Selected: C
If DW (which need modify permission) already has assigned the right permission only with viewer the User3 could view all items
vish9
👍 5
Selected: C
Assign the Viewer role to User3 to allow viewing all workspace items. Object-level permissions already cover updates to DW1, ensuring least privilege is maintained.
GadAugust
👍 5
Selected: C
This is a really tricky question and the answer does not just lay in the coarse grained workspace roles https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces The user should be able to view the items in the workspace - VIEWER The user can already update the tables in the DW1 database through object-level permissions So if you apply the Principle of Least privilege, VIEWER is all that is required. All other roles will elevate the user privilege over and above the requirements.
zxc01
👍 3
Yes, tricky question again. We just can guess grant user3 has two steps if we choose role viewer on workspace level. the next step should grant user permission on warehouse roles. However, question doesn't give enough details for just can add user on workspace level or both workspace and item level. It will be changed to clear if Microsoft change this question to "You already assigned the appropriate object-level permissions to User3."
Goye
👍 1
Selected: B
member can create or modify warehouse items according to doc, contributors can’t https://learn.microsoft.com/en-us/fabric/fundamentals/roles-workspaces#-workspace-roles
benni_ale
👍 1
Selected: C
you could assign viewer role in the workspace which won't overwrite the the appropriate-already-configured object-level permission on dw1 so the user will be able to view all objects in ws1 but will also be able to run update statements within the dw1
benni_ale
👍 1
please correct me if i am wrong otherwise is D
prabhjot
👍 1
Selected: D
Contributor fits the best as being a member would grant the user the power to add other users to the workspace, thus defeating the whole purpose of the question - "Least Privileged Access"
18e18d0
👍 1
Selected: D
It is not specified that the user should be able to add other users to Workspace. Contributors can modify data, but not add others to Workspace. According to the documentation - Contributor is the least privileged role: https://learn.microsoft.com/en-us/fabric/security/permission-model#workspace-roles
Bovote
👍 1
Selected: D
Viewer - Can view all content in the workspace, but can't modify it. Contributor - Can view and modify all content in the workspace. Member - Can view, modify, and share all content in the workspace. Can add Members Admin - Can view, modify, share, and manage all content in the workspace, including managing permissions. - Can add Admins, Members and can delete workspace. So Contributor is the least role who can view and update the tables (modify the content).
bettermakeme
👍 3
To clear everyone's doubt , even if user have warehouse object level access only contributor role can provide modify permission in warehouse
4371883
👍 1
Selected: D
Contributor is the least privilege role according to this. https://learn.microsoft.com/en-us/fabric/security/permission-model
gfors
👍 2
Selected: D
This is wrong in the docs. Read this https://community.fabric.microsoft.com/t5/Service/Create-or-modify-warehouse-items-can-do-with-Contributor-role/m-p/4318708
doctordodge
👍 1
This is only a custom-setting that can be given to a Contributor role by an Admin. It is not a default. Default is that contributors cannot modify warehouse items. Only Members and Admins can do so by default.
GHill1982
👍 1
Thanks for the link, very useful
01ceacf
👍 8
Selected: B
Only member or above can modify warehouse items https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces
zxc01
👍 2
As I understand, the explain "Create or modify warehouse items." in this document means member role can create and modify warehouse. If you check Microsoft documents for item level permission, they all said item on high level, such as lakehouse, warehouse. Item doesn't mean objects inside warehouse. Contributor role can update table data inside warehouse.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Viewer is the minimum Fabric workspace role that lets User3 see every item in Workspace1. The scenario explicitly says appropriate object-level permissions on DW1 are already assigned, so the ability to update DW1 tables does not need to come from the workspace role. Viewer therefore satisfies both required actions without granting edit or administration rights over Pipeline1 or other workspace items. This aligns with least privilege because the only workspace-level capability added is read/view access.Why the Other Options Are Wrong
Contributor can view items and edit content, but that extra edit capability would also let User3 modify Pipeline1, which the scenario does not require. Member adds broader content and collaboration rights beyond Contributor, and Admin adds workspace administration including role and settings management. None of those higher roles are needed once DW1 object-level permissions are in place, and each violates least privilege by granting unnecessary control. The trap is assuming the workspace role must be the source of the DW1 update permission.Community Comment Notes
Several learners, including GadAugust and ShazzyHawk, keyed on the phrase "You already assigned the appropriate object-level permissions to DW1" and concluded that Viewer is enough for least privilege. Iconsulting made the same point practically: Contributor would also let User3 modify Pipeline1, which the requirements do not ask for. 01ceacf raised the opposing view that "Only member or above can modify warehouse items", but that reasoning ignores the stated object-level DW1 grant. PBridge chose Contributor based on a role breakdown, yet that breakdown does not account for the pre-assigned warehouse permissions.Official Reference
Exam Strategy
Read the 'already assigned object-level permissions' clause as a signal that the workspace role only needs to cover visibility. Map each required action to the minimum Fabric role, then check whether a higher role grants unnecessary edit rights to other items such as Pipeline1.
Frequently Asked Questions
Why doesn't User3 need the Contributor role to update tables in DW1?
Because appropriate object-level permissions on DW1 are already assigned; Contributor would also allow edits to Pipeline1 and other workspace items, violating least privilege.
Can a Fabric Viewer on Workspace1 still update DW1 tables?
Yes, if DW1 has explicit object-level permissions for User3; the workspace Viewer role controls item visibility, while the warehouse permission grants the update capability.