Power BI Workspace Roles: Admin, Member, Contributor, Viewer

Power BI workspace roles are Admin, Member, Contributor and Viewer, the four roles you can assign in a workspace. Each one controls a different level of access to the reports, dashboards, semantic models and dataflows inside it, from full control down to read-only. You assign a role to a person or a group when you give them access to the workspace, and that role decides what they can do there.

The four Power BI workspace roles

Admin

Admin is the highest role. An Admin can update or delete the workspace itself, add or remove any user in any role, and manage everything a Member, Contributor or Viewer can do. This is the role for whoever owns the workspace: a team lead, a BI admin, or the person accountable for what gets published from it.

Member

A Member can create, edit, copy and delete content, publish and unpublish the workspace app, and add other users to the workspace, as long as their role isn't higher than Member's own. A Member cannot remove an existing user or change their role; only an Admin can do that. This role suits someone who actively builds and maintains reports and needs to bring teammates in, but doesn't need to manage the workspace's own settings.

Contributor

A Contributor can create, edit and delete content, copy reports, schedule refreshes and connect to the semantic models in the workspace to build new reports elsewhere. A Contributor cannot add or remove users, and cannot publish or unpublish the app unless an Admin has specifically turned on Allow Contributors to update the app for the workspace. This is the role for an analyst or developer who builds reports but shouldn't manage who else has access.

Viewer

A Viewer can view and interact with reports and dashboards, and read data from the workspace's dataflows, but cannot edit anything. Row-level security still applies to a Viewer exactly as it does to any other role, so a Viewer only sees the rows their security role allows. Viewers can also receive subscriptions and, if given Build permission on a semantic model, use Analyze in Excel or export the model's underlying data.

Role-by-permission table

Source: Roles in workspaces in Power BI, trimmed to the capabilities most readers need to assign a role.

Licensing for each role

Every capability except viewing and interacting with an item requires a Power BI Pro or Premium Per User (PPU) license. That means Admins, Members and Contributors need a Pro or PPU license in almost every workspace, because building or publishing content is not part of the free tier.

Viewers are the exception, and this is the part that trips people up. A Viewer only avoids needing a Pro or PPU license when the workspace sits on a capacity of F64 or larger, or a legacy Power BI Premium P SKU (P1 through P5). Every P SKU already meets this bar, since P1 maps to F64-equivalent capacity units and P2 through P5 are larger still.

A workspace on a smaller Fabric capacity, such as F2, F4, F8, F16 or F32, does not qualify, so a Viewer there still needs a Pro or PPU license. If your organization is on a Fabric trial or a small F-SKU capacity, don't assume "we're on Fabric" is enough to give free viewers access; check the actual SKU size. See our guide to Power BI Premium capacity for how the F-SKU sizes map to the old P SKUs.

Publishing enforces this too: trying to publish a report from Power BI Desktop without a Pro or PPU license returns the error "Only users with Power BI Pro licenses can publish to this workspace," regardless of which role you hold.

How to assign a role

1. Open the workspace in the Power BI service and select Access in the top-right corner.

2. Enter the email address of the person or group you want to add.

3. Select their role from the dropdown: Admin, Member, Contributor or Viewer.

4. Select Add.

The Access panel's role dropdown. You can assign security groups, Microsoft 365 groups and distribution lists the same way as individuals.

To change someone's existing role, an Admin has to remove them first; a Member can add a new user but cannot edit or remove one that's already there.

Workspace roles vs item-level permissions

A workspace role is not the only way someone gets access to Power BI content. Sharing a single report or dashboard directly grants read access to that item without putting the recipient in any workspace role at all. An app does the same for a packaged set of reports. Neither shows up in the workspace's Access list, so if you're auditing who can see something, check both the workspace roles and any direct shares or apps built from it.

Build permission works the other way: it's a grant on a specific semantic model, separate from workspace roles, that lets someone connect their own tools to that model, use Analyze in Excel, or export its underlying data. A Contributor or Member already has Build permission on every semantic model in their own workspace through their role. A Viewer does not, which is why Viewers need Build permission granted explicitly before Analyze in Excel or export will work for them.

Managing roles well

• Give Admin to as few people as possible. Every Admin can delete the workspace and remove any other user, so limit it to whoever is actually accountable for the workspace.

• Use groups, not individual emails, for teams. Assigning a Microsoft 365 group or security group to a role means adding or removing one person from the group updates their access everywhere that group is used, instead of editing every workspace by hand.

• Review access on a schedule. Roles drift as people change teams. A periodic check against who's still on the project catches access nobody remembers granting.

• Use Viewer plus row-level security for anyone who should only see their own data, rather than filtering manually in each report. See our guide to row-level security for how to set that up.

• Publish an app instead of adding everyone to the workspace role list, if the audience is large or shouldn't see the workspace's editing surface at all. An app gives read access without a workspace role. Our guide to workspaces and apps covers the difference.

FAQs

Can a user have multiple roles in the same Power BI workspace?

No. A user has one role per workspace. If someone belongs to more than one Microsoft 365 group and those groups hold different roles in the same workspace, they get the highest permission level among them.

Do all workspace roles require a Power BI Pro license?

Admin, Member and Contributor need a Pro or PPU license in almost every case, because those roles create or publish content. Viewer is the one role that can work without a license, but only when the workspace is on an F64 or larger Fabric capacity, or a legacy P SKU. On a smaller capacity or in shared (non-Premium) capacity, Viewers need a Pro or PPU license too.

Does a Fabric trial capacity count as F64 for free viewers?

It depends on the SKU the trial assigns. Fabric trial capacities are given either an F4 or an F64 SKU and take on that SKU's limits for the length of the trial. An F4 trial capacity does not meet the F64 threshold, so Viewers on it still need a license. Check the actual SKU assigned to your trial in the Fabric admin portal rather than assuming.

Sources

• Roles in workspaces in Power BI - Microsoft Learn

• What is Power BI Premium? - Microsoft Learn