Create or modify warehouse items - can do with Contributor role

[Aleh_P]

Here https://learn.microsoft.com/en-us/fabric/get-started/roles-workspaces#-workspace-roles I see that "Create or modify warehouse items." can Admin or Member only. In Fact I tested and I can do this with Contributor role - I went and create warehouse and some teables inside with Contributor role at the Workspace. 

Can someone clarify what then this   "Create or modify warehouse items." means  and why Contributor can still do the warehouse items management ?

[Didier_VDBerghe · Accepted solution]

Hi, @Aleh_P,

With the permission "Create or modify warehouse items." one is allowed to create and modify a warehouse which is the container. This is only possible whe you are Admin or Member at workspace level.

When referring to creating or modifying warehouse items which are inside the warehouse container, you should at least have Contributor permissions at workspace level (Data warehouse security) or at the warehouse item level.

With kind regards,

Didier (Belgium)   

[v-sgandrathi]

Hi, @Aleh_P 

We wanted to follow up since we haven't heard back from you regarding our last response. We hope your issue has been resolved.

If my answer resolved your query, please mark it as "Accept Answer" and select "Yes" if it was helpful.

If you need any further assistance, feel free to reach out.

Thank you for being a valued member of the Microsoft Fabric Community Forum!

[v-sgandrathi]

Hi @Aleh_P,

May I ask if you have gotten this issue resolved?

If it is solved, please mark the helpful reply or share your solution and accept it as solution, it will be helpful for other members of the community who have similar problems as yours to solve it faster.

Regards,
Sahasra.

[v-sgandrathi]

Hi, @Aleh_P 

Thanks for reaching out to the Microsoft Fabric Community forum

A Contributor in Microsoft Fabric can create Warehouse items if the workspace settings or permissions allow it. 

Reason:

The ability to create Warehouse items depends on workspace configuration. While the default Microsoft Fabric permissions model might not explicitly list this capability for Contributors in the official documentation, workspace admins can enable or restrict this functionality through customized role settings. If you are able to create Warehouse items, it is likely due to your workspace's specific configuration.

To summarize:

Default Behavior: Contributors may not typically create Warehouse items.

Custom Configuration: Workspace admins can grant Contributors this capability.

Check with your workspace admin to confirm how permissions are set in your environment.

If this post was helpful, please consider marking Accepting it as a solution to guide other members in finding it more easily.

Regards,
Sahasra.

[GilbertQ]

Hi @Aleh_P 

This can also depend what the permissions are on the Warehouse.

For the same user what permissions do they have in the Warehouse?

[Aleh_P]

Hi @GilbertQ 

There are no any permissions on Warehouse for this user. 

I want to understand does Contributor workspace role enough to work with Warehouse reagardless documentation said you need t obe memeber or admin. 

I have created brand new workspace and assign Contributor role to test user. Then go and using this test uer created warehouse and tables. I do not apply andy T-SQL and internal scecurity.

Morover I think it is not relevant to Warehouse SQL security at all, because we are talking about workspace level roles and permissions to "Create or modify warehouse items". Warehouse items in MS Fabric is Warehouse object. 
In fact it looks either mistake/wrong text ("Create or modify warehouse items") in the security page or some BIG security flaw. 

[pallavi_r]

Hi @Aleh_P ,

Contributor role is the minimum access we can provide to any user for collaborating (read and write access) to all the items inside a workspace.

https://learn.microsoft.com/en-us/fabric/data-warehouse/share-warehouse-manage-permissions

https://learn.microsoft.com/en-us/fabric/security/permission-model

Thanks,

Pallavi

[GilbertQ]

Hi @Aleh_P 

Based on the documentation in the link below it appears that the contributor can read and write.

Roles in workspaces in Microsoft Fabric - Microsoft Fabric | Microsoft Learn

If you want a user to have less permissions I would remove him from the App Workspace Roles and grant them permissions in the Warehouse ONLY.