5.2.1. Workspace Roles and Item-Level Access

💡 First Principle: Workspace roles grant capabilities over everything in a workspace; item-level access grants a specific capability over one item. Use roles for the people who build and manage content, and item permissions or apps for the people who consume it.

Assign roles to Microsoft Entra security groups, Microsoft 365 groups, or distribution lists where possible rather than individuals, so membership changes are managed centrally. Least privilege guidance: Contributors for report authors who don't manage access, Members for those who also publish apps and share, Admins only for workspace owners, Viewers for read-only consumers (or better, use an app).

Item-level access grants permissions to a single item without workspace membership:

• Share a report or dashboard (Share button) with people or groups, optionally allowing them to reshare and to build content with the underlying semantic model. Sharing grants Read on the item and its semantic model.
• Links can target people in your organization, people with existing access, or specific people.
• Manage permissions on an item shows who has access (direct, via links, via workspace role, via app) and lets you remove or change it.
• Item access is additive: a user can have no workspace role yet still view a shared report; their RLS role still applies.

⚠️ Exam Trap: Making a report author a Contributor lets them publish and edit content without giving them power to add workspace members, share items, or (by default) update the app. When the requirement is "create and edit reports but not manage access," Contributor is the least-privilege role; Member over-grants.

Reflection Question: A team lead needs to publish and update the department app and share individual reports, but must not be able to delete the workspace or add other admins. Which role fits, and what would Contributor fail to allow?