Forum Discussion
Post PatronDomain permissions & workspace roles
- Workspace1 - Admin: User1
- Workspace2 - Admin: User2
- Group1 contains User1 and User3
- Domain1 - Admin: User1
- Domain2 - Admin: User2
- User1 creates Workspace3
- Group1 is added to the default domain of Domain1
Hi tan_thiamhuat,
Domain permissions do not grant workspace roles on their own. A domain can control things like workspace grouping, governance settings, and default behaviors, but it does not automatically assign Viewer, Member, Contributor, or Admin roles to users for any workspace inside that domain.
In your example:
User1 creates Workspace3 under Domain1
Group1 is added to the default domain of Domain1
Group1 contains User1 and User3
Even with that setup, User3 will not get Viewer access (or any workspace role) to Workspace3 unless someone explicitly assigns Group1 or User3 to that workspace with a workspace role.
Domain = governance scope
Workspace roles = access permissionsThey are completely separate. Domains never override or auto-populate workspace permissions.
So the final answer is: No — User3 will not have Viewer access to Workspace3 unless you manually give it at the workspace level.
Hope this helps. If so, please give a Kudos 👍 or mark as Accepted Solution ✔️
– Gopi Krishna
3 Replies
- Ugk161610
Super User
Hi tan_thiamhuat,
Domain permissions do not grant workspace roles on their own. A domain can control things like workspace grouping, governance settings, and default behaviors, but it does not automatically assign Viewer, Member, Contributor, or Admin roles to users for any workspace inside that domain.
In your example:
User1 creates Workspace3 under Domain1
Group1 is added to the default domain of Domain1
Group1 contains User1 and User3
Even with that setup, User3 will not get Viewer access (or any workspace role) to Workspace3 unless someone explicitly assigns Group1 or User3 to that workspace with a workspace role.
Domain = governance scope
Workspace roles = access permissionsThey are completely separate. Domains never override or auto-populate workspace permissions.
So the final answer is: No — User3 will not have Viewer access to Workspace3 unless you manually give it at the workspace level.
Hope this helps. If so, please give a Kudos 👍 or mark as Accepted Solution ✔️
– Gopi Krishna
tan_thiamhuatso the reasoning below is wrong?
When User1 creates Workspace3 and adds Group1 to Domain1 (the default domain), User3 gains access because:
- User3 is a member of Group1
- Group1 has been assigned to Domain1
- When a workspace is assigned to a domain, the domain contributors typically get at least Viewer access to workspaces in that domain
- Since User3 is part of Group1 which is now associated with Domain1, User3 would have Viewer access to Workspace3
Hi tan_thiamhuat
Check this link, it may be helpful.https://learn.microsoft.com/en-us/fabric/governance/domains#domain-roles
