How to prevent a user from publishing reports in all workspaces including their own?

[HalimeUstundag]

Hi everyone,

I have a requirement to restrict a specific user from publishing Power BI reports in any workspace, including their own workspace.

Currently, the user is able to publish reports, and I want to completely remove this capability.

I want to ensure the following:
The user cannot publish reports to any existing workspace
The user cannot publish reports to their own workspace
The user cannot create new workspaces and publish there

What is the best way to enforce this restriction?

Should this be handled through workspace roles such as setting the user to Viewer?
Or should I use tenant settings like restricting workspace creation or publish permissions?
Are there any recommended best practices for this type of governance?

Thanks in advance.

[parry2k]

https://learn.microsoft.com/en-us/fabric/admin/portal-workspace#block-users-from-reassigning-persona...

[v-menakakota]

Hi @HalimeUstundag ,
Thanks for reaching out to the Microsoft fabric community forum. 

I would also take a moment to thank  @parry2k and @Juan-Power-bi  , for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference. 
I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you.

Best Regards, 
Community Support Team

[v-menakakota]

Hi @HalimeUstundag ,

I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you.

Best Regards, 
Community Support Team

[parry2k]

You can disable creating of my workspace in tenant settings. So it can be taken care of. 

[Juan-Power-bi · Accepted solution]

mmm Not really,

the tricky part is "My Workspace" because every licensed user automatically owns it and can publish there. The only way to fully block that is either removing their Pro/Fabric license entirely, or assigning them a free license instead, which strips publishing capability everywhere including their own workspace.

[parry2k]

@HalimeUstundag, one more option: if they don't need access to the Power BI service at all, remove the PRO license from the user; it will revoke all permissions.

[parry2k]

@HalimeUstundag Two way settings:

- allow user not to create workspaces: tenant setting

- for existing workspaces where they need read-only access, add the user as a viewer, and for other workspaces where they don't need any access, including read-only, don't add the user with any role.