Granular level tenant setting to control who can create workspace apps

[MSuszczewicz]

Currently, Microsoft Fabric (and Power BI) does not provide a tenant setting to restrict workspace app creation to specific security groups.

The available controls are:

Workspace roles:
Member role includes the ability to publish apps and manage permissions.
Contributor role removes app publishing rights but also removes the ability to manage permissions on reports/models.

Tenant settings:

You can restrict workspace creation to specific security groups.

You can control whether users can publish apps to the entire organization, but not who can create apps in general.

There is no built-in setting today to allow Members to manage permissions but block app creation.

The only way to achieve this currently is:

Use Contributor role for self-service workspaces (blocks app creation).

Grant item-level permissions on reports/models to allow sharing without giving full Member rights.

Could I please ask for a tenant setting that would allow me to control who can create workspace apps, regardless of their workspace roles?

Thank you.