Forum Discussion
User with Contributor Role Unable to Checkout Branches or Create New Workspaces
Hi ifeanyi
-
Thank you for sharing your thoughtful workaround for managing least-privilege access in Microsoft Fabric.
-
We understand the current limitations around granular role-based permissions, especially compared to Synapse or Data Factory.
-
Using a dedicated collaboration workspace to isolate contributor access is a practical and effective solution.
In the meantime, if you're open to it, we recommend sharing your approach and suggestions on the Fabric Ideas - Microsoft Fabric Community It’s actively reviewed by the product team and helps influence future roadmap priorities.
Let us know if you’d like assistance with anything else or help streamlining your current setup further.
Thanks for being a part of Microsoft Fabric Community Forum.-
Super UserHello ifeanyi
This is expected behaviour.
The Contributor role in Microsoft Fabric allows users to view and modify content within a workspace but does not include permissions for managing workspace settings or advanced configurations like Git integration. These capabilities are typically reserved for Members and Admins
Members can perform tasks such as sharing content, adding users with lower permissions, and managing some workspace settings, while Admins have full control over workspace management, including permissions and configurations
https://learn.microsoft.com/en-us/fabric/security/permission-model
Please accept this answer and give kudos if this is helpful
Hi nilendraFabric ,
Thank you for your response. I understand that Contributors have limited permissions compared to Members and Admins. However, the Microsoft Fabric Git integration documentation suggests Contributors should be able to checkout branches and create workspaces as part of the Git workflow.
Could there be additional settings or restrictions causing this, or is the documentation outdated? I’d appreciate further clarification.
Thanks again!
- nilendraFabric
Hello ifeanyi
Contributor role can pull updates from Git (“Update from Git”) and push or commit changes (“Commit workspace changes to Git”) only if they have full WRITE rights on all items that need modification. This means:
• The user must be granted the Contributor role in the workspace.
• Their corresponding Git repository permissions should be set to allow both reading (Read=Allow) and contributing (Contribute=Allow) changes.
• Additionally, branch policies must be configured to permit direct commits. If the branch has requirements like pull requests or other controls, those rules must be respected, and direct commits might not be allowed.see if this is all done and then test it.
Hi nilendraFabric ,
Thank you for the detailed explanation. To clarify, I have already assigned the user the Contributor role in the workspace and granted them Project Contributor access to the project from the Azure DevOps Git repository.
I assumed that (Read=Allow) and (Contribute=Allow) permissions would be applied automatically, as this was the case in previous setups where users with the Contributor role in the workspace could perform Git operations without additional configuration.
However, I reviewed the Azure DevOps Git repository settings under Project Settings --> Permissions --> Contributors and did not find the explicit (Read=Allow) option as described in the image below.
Could you please confirm if these permissions are managed elsewhere or if there’s an additional step I might be missing?
Thank you for your support!
