Which workspace role meets least privilege for viewing items and updating DW1?

DP-700 By islever Editorial Last updated

Configure security and governance Configure Microsoft Fabric workspace settings

Short answer

C Assign the Viewer workspace role so User3 can view all Workspace1 items, while existing object-level DW1 permissions handle table updates with least privilege.

Question

You have a Fabric workspace named Workspace1 that contains a warehouse named DW1 and a data pipeline named Pipeline1.
You plan to add a user named User3 to Workspace1.
You need to ensure that User3 can perform the following actions:
View all the items in Workspace1.
Update the tables in DW1.
The solution must follow the principle of least privilege.
You already assigned the appropriate object-level permissions to DW1.
Which workspace role should you assign to User3?
  1. Admin
  2. Member
  3. Viewer Correct Answer
  4. Contributor

Key Takeaways

This question tests separating Fabric workspace roles from object-level warehouse permissions; the trap is assuming Contributor is required to update DW1 tables.

Fabric workspace roles control item visibility, while warehouse object-level permissions grant T-SQL access. This page explains why Viewer is the least-privilege role for User3 when DW1 permissions are already assigned.

Common mistake: Choosing Contributor because it can edit warehouse data, overlooking that object-level permissions already grant DW1 updates and Contributor would also allow editing Pipeline1.

Expert Analysis

Why the Answer Is Correct

Viewer is the minimum Fabric workspace role that lets User3 see every item in Workspace1. The scenario explicitly says appropriate object-level permissions on DW1 are already assigned, so the ability to update DW1 tables does not need to come from the workspace role. Viewer therefore satisfies both required actions without granting edit or administration rights over Pipeline1 or other workspace items. This aligns with least privilege because the only workspace-level capability added is read/view access.

Why the Other Options Are Wrong

Contributor can view items and edit content, but that extra edit capability would also let User3 modify Pipeline1, which the scenario does not require. Member adds broader content and collaboration rights beyond Contributor, and Admin adds workspace administration including role and settings management. None of those higher roles are needed once DW1 object-level permissions are in place, and each violates least privilege by granting unnecessary control. The trap is assuming the workspace role must be the source of the DW1 update permission.

Community Comment Notes

Several learners, including GadAugust and ShazzyHawk, keyed on the phrase "You already assigned the appropriate object-level permissions to DW1" and concluded that Viewer is enough for least privilege. Iconsulting made the same point practically: Contributor would also let User3 modify Pipeline1, which the requirements do not ask for. 01ceacf raised the opposing view that "Only member or above can modify warehouse items", but that reasoning ignores the stated object-level DW1 grant. PBridge chose Contributor based on a role breakdown, yet that breakdown does not account for the pre-assigned warehouse permissions.

Official Reference

https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces

This link opens the official vendor documentation in a new tab.

Exam Strategy

Read the 'already assigned object-level permissions' clause as a signal that the workspace role only needs to cover visibility. Map each required action to the minimum Fabric role, then check whether a higher role grants unnecessary edit rights to other items such as Pipeline1.

Frequently Asked Questions

Why doesn't User3 need the Contributor role to update tables in DW1?

Because appropriate object-level permissions on DW1 are already assigned; Contributor would also allow edits to Pipeline1 and other workspace items, violating least privilege.

Can a Fabric Viewer on Workspace1 still update DW1 tables?

Yes, if DW1 has explicit object-level permissions for User3; the workspace Viewer role controls item visibility, while the warehouse permission grants the update capability.

More DP-700 FAQ →

Discussion 56 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 56

  1. 01ceacf 👍 8 Answered B
    Only member or above can modify warehouse items https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces
  2. GadAugust 👍 5 Answered C
    This is a really tricky question and the answer does not just lay in the coarse grained workspace roles https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces The user should be able to view the items in the workspace - VIEWER The user can already update the tables in the DW1 database through object-level permissions So if you apply the Principle of Least privilege, VIEWER is all that is required. All other roles will elevate the user privilege over and above the requirements.
  3. vish9 👍 5 Answered C
    Assign the Viewer role to User3 to allow viewing all workspace items. Object-level permissions already cover updates to DW1, ensuring least privilege is maintained.
  4. ShazzyHawk 👍 4 Answered C
    “You already assigned the appropriate object-level permissions to DW1” changes everything. Object-level permissions on DW1 override workspace-level edit restrictions. A Viewer role on the workspace allows the user to see all workspace items, while the object-level permissions on DW1 allow them to update data in the warehouse. Therefore, granting Contributor or higher would violate least privilege, since those roles allow editing other workspace items.
  5. luckybalaji 👍 4 Answered C
    Viewer only gives the least privilege, giving contributor role makes permission to amend pipeline1 it is note required as per question.
Show 25 more comments
  1. montoya207 👍 3 Answered C
    The correct answer is C. Viewer. Here is the technical justification based on the sources: Viewing items: The Viewer role allows the user to view all items in the workspace (Workspace1), fulfilling the first requirement. Updating data: In Fabric, T-SQL permissions (such as UPDATE or INSERT) are managed at the database engine level. If you have already assigned the appropriate object-level permissions, the user only needs “Read” access to the Warehouse element to connect to its SQL connection point. The Viewer role grants this basic access.
  2. PBridge 👍 3 Answered D
    Explanation: You need to ensure that User3 can: View all items in the workspace Update tables in DW1 Follow the principle of least privilege Roles breakdown: Admin: Too much access (can delete, manage roles, settings, etc.) Member: Also more permissions than needed (can publish and manage content broadly) Viewer: Read-only — cannot update DW1 ✅ Contributor: Can view all items Can edit datasets, dataflows, pipelines, and warehouses (if object-level permissions are granted) Fits the least privilege principle
  3. zxc01 👍 3
    Yes, tricky question again. We just can guess grant user3 has two steps if we choose role viewer on workspace level. the next step should grant user permission on warehouse roles. However, question doesn't give enough details for just can add user on workspace level or both workspace and item level. It will be changed to clear if Microsoft change this question to "You already assigned the appropriate object-level permissions to User3."
  4. a74cb2b 👍 3 Answered C
    "You already assigned the appropriate object-level permissions to DW1." => this overwrites the general workspace level restrictions on Viewer, allowing User3 to update the the tables in DW1. Admin, Member, and Contributor all grant Control access to warehouses, while Viewer grants Connect and ReadData permissions. When combined with object-level SQL permissions, Viewer satisfies the requirements while following least privilege.
  5. 95704b2 👍 3 Answered C
    C is the correct answer based on principle of least privilege Viewer can view all the content of the Workspace and since you already assigned the appropriate object-level permissions to DW1
  6. Iconsulting 👍 3 Answered C
    If you assign the Contributor role to User3, they can also modify Pipeline1, thus violating the principle of least privilege, which is a requirement.
  7. bettermakeme 👍 3
    To clear everyone's doubt , even if user have warehouse object level access only contributor role can provide modify permission in warehouse
  8. Adriel_1996 👍 3 Answered C
    If DW (which need modify permission) already has assigned the right permission only with viewer the User3 could view all items
  9. 5dcd3a8 👍 2 Answered D
    The Viewer role allows a user to: See all items in the workspace Cannot open notebooks or pipelines Cannot run queries or update data, even if object-level permissions are granted Viewer role is strictly read-only at the workspace level, regardless of object-level permissions. Why Contributor is correct: Can view all items in the workspace Can interact with items (like run pipelines, notebooks) With object-level permissions, can update data in DW1 Does not have management privileges (unlike Member or Admin) Contributor + object-level permissions = just enough rights to view and update without overreaching — perfect for least privilege.
  10. emboutchamani 👍 2 Answered C
    In Microsoft Fabric, the Viewer role provides "Read" permissions on the Warehouse item, which allows the user to connect to the Warehouse via the SQL endpoint. The actual ability to modify data (INSERT/UPDATE/DELETE) or schema (DDL) is controlled by SQL object-level permissions inside the Warehouse. Since the prompt states you have "already assigned the appropriate object-level permissions to DW1" (e.g., GRANT UPDATE, db_datawriter), the User only needs the connectivity provided by the Viewer role to utilize those SQL permissions.
  11. e71e79b 👍 2 Answered D
    A Contributor can view all items in a Fabric workspace and interact with specific objects—like updating tables—as long as they already have object-level permissions. Since you’ve already given User3 the necessary object-level permissions on DW1, this role grants just enough access without overstepping boundaries. Perfect alignment with the principle of least privilege.
  12. zxc01 👍 2
    As I understand, the explain "Create or modify warehouse items." in this document means member role can create and modify warehouse. If you check Microsoft documents for item level permission, they all said item on high level, such as lakehouse, warehouse. Item doesn't mean objects inside warehouse. Contributor role can update table data inside warehouse.
  13. rc012345 👍 2 Answered C
    Viewer access at workspace level. In the warehouse (OLS) - sql query: Granted UPDATE, INSERT access on table level to "user-email" Result: User able to update (insert) values to respective table.
  14. fdsdfgxcvbdsfhshfg 👍 2 Answered D
    You would think that SQL Granular Permissions would work even for a viewer workspace role, like in the case of Synpase I believe, but here Fabric won't allow an UPDATE statement for a viewer.
  15. Bin_Hashim 👍 2 Answered C
    According to these words from Question "You already assigned the appropriate object-level permissions to DW1." (this seems tricky part of the question) C. Viewer
  16. gfors 👍 2 Answered D
    This is wrong in the docs. Read this https://community.fabric.microsoft.com/t5/Service/Create-or-modify-warehouse-items-can-do-with-Contributor-role/m-p/4318708
  17. e0f0ce6 👍 2 Answered C
    "You already assigned the appropriate object-level permissions to DW1." This ensures the ability to read write in the DW. For the rest Viewer is enough.
  18. 9a69b12 👍 2 Answered C
    "You already assigned the appropriate object-level permissions to DW1." meaning that the user, if granted VIEW, has all necessary permissions.
  19. Ce____ 👍 2 Answered D
    D Remains the answer, a viewer can't modify the contents of a workspace, just to view, a most acceptable with least privilege is Contributor
  20. alinavit 👍 2 Answered C
    It states: "You already assigned the appropriate object-level permissions to DW1." So it is enough to select viewer role Verified in Fabric
  21. Jay63002 👍 2 Answered D
    as per this doc, contributor can create and modify warehouse item : https://learn.microsoft.com/en-us/fabric/fundamentals/roles-workspaces
  22. wellingtonluis 👍 2 Answered C
    The Key phrase here is: "You already assigned the appropriate object-level permissions to DW1". So Viewer in Workspace is enought.
  23. aws123 👍 2 Answered C
    "You already assigned the appropriate object-level permissions to DW1" so viewer is the best answer with least privileges
  24. alex_sql 👍 2
    Viewer + permisos a nivel objeto: solo puede consultar, no puede modificar.
  25. ts_au 👍 2 Answered C
    they already have access to DW1

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

A 500-million-row fact table exceeds the F32 Direct Lake guardrail, so increase the capacity to F64

S-grade

Shortcut caching supports only S3/GCS shortcuts and excludes files larger than 1 GB

S-grade

Updating warehouse tables requires at least the Contributor workspace role because Write is not shareable to a Viewer

S-grade

Run T-SQL in a KQL database only by prefixing the query with a -- comment line

S-grade

← Back to DP-700 Study Guide