Make production workspace items read-only (editable only via Deployment Pipeline, Git, or API)

[frithjof_v]

Please add a workspace-level toggle that allows the workspace admin to make all items read-only in the Fabric user interface.

With this setting enabled, items (such as notebooks, semantic models, dataflows, etc.) cannot be edited, created, or deleted manually via the UI. Instead, all changes must go through:

• Deployment Pipelines
• Git
• API

Ideal implementation:

A toggle in the workspace settings (e.g. “Make items read-only in UI”).

Only workspace admins can enable/disable this setting.

[frithjof_v]

I want to prevent unintended changes to items in production workspaces. Specifically, sometimes I want to open items in the prod workspace to inspect the code, but I don't want the risk of making unintended errors (or items saving themselves via auto-save while I have opened the item).

[frithjof_v]

To be clear: My intention is only to make the items' source code read-only in prod workspaces. I still want to be able to set up refresh schedule in the prod workspace, for example. But I don't want to be able to edit the items' source code in prod. That should only be done in dev.

[SJCuthbertson]

I like this idea and would use it if it existed today. This is a friction/pain area I also have. But it probably doesn't go far enough, in that the 4 defined workspace roles we have (Admin, Member, Contributor, Viewer) don't make nearly enough distinction between what in Azure is called "data plane" vs "control plane". @frithjof_v , I _think_ your idea here is essentially about toggling the definition of the Member and Contributor roles, to restrict them to (mostly) just the subset of their capabilities that could be described as "data plane" (doing things with data in LH/WH/EH etc), and negating (most of) the subset of their capabilities that are "control plane" (doing things with workspace objects). Is that fair? I suspect it's more fruitful to rethink that paradigm more broadly, and based on murmurs and comments I've seen, I think that might be on the way already, which might make this suggested toggle unnecessary.

[BEJCC]

Production is a read only workspace, therefore all members assigned to it have viewer role. Does not matter if the tenant setting is enabled or not everyone is viewer. Only admin user can edit hotfixes on production.