A workspace has four roles:
- Admin: everything, including deleting the workspace and managing all roles.
- Member: publish and edit content, add people with Member or lower roles, publish the app.
- Contributor: create, edit and publish content, but not manage access.
- Viewer: view content only.
You can also share a single report or semantic model. Build permission on a semantic model lets someone create their own reports on it, even from another workspace.
Row-level security roles are written in Desktop, but people are assigned to roles in the service, in the semantic model's Security settings. RLS limits Viewers; Admins, Members and Contributors can edit the model, so it doesn't restrict them.
Sensitivity labels (Microsoft Purview) mark content such as Confidential. The label travels with exports to Excel, PowerPoint and PDF.