Question
You have a Fabric workspace named Workspace1 that contains a warehouse named DW1 and a data pipeline named Pipeline1.
You plan to add a user named User3 to Workspace1.
You need to ensure that User3 can perform the following actions:
- View all the items in Workspace1.
- Update the tables in DW1.
The solution must follow the principle of least privilege.
You already assigned the appropriate object-level permissions to DW1.
Which workspace role should you assign to User3?
- A. Admin
- B. Member
- C. Viewer Correct
- D. Contributor
Explanation
The Viewer role lets User3 see every item in Workspace1 and grants CONNECT and ReadData on each warehouse. The object-level T-SQL permissions you already granted on DW1, such as INSERT and UPDATE, give User3 the ability to change its tables. Contributor, Member and Admin each grant CONTROL on every warehouse and SQL analytics endpoint in the workspace, plus the right to edit other items, which is more than User3 needs. Because table-level write access is already handled with SQL permissions, Viewer is the least privileged role.
