Forum Discussion
Deployment Pipeline permissions
Hi. That's not possible. The role for deploy and upgrade app are the same. I don't think there is a role to only deploy and not upgrade. You can check permissions at the following docs:
- Deployment pipelines: https://learn.microsoft.com/en-us/power-bi/create-reports/deployment-pipelines-process#permissions-table- Workspaces: https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-roles-new-workspaces#workspace-roles
As an alternative, you could create a script for Deploy with Service Principal using the Power Bi Rest API. Let the Contributor a permission for running the script. You could use runbooks, azure functions or even local things with the secrets hidden. That way the contributor can't update the app but they could deploy with the script. You can check the request from here:
https://learn.microsoft.com/en-us/rest/api/power-bi/pipelines/selective-deploy
There are cmdlets for powershell or libraries for python like SimplePBI.
I hope that helps,
Hi. That's not possible. The role for deploy and upgrade app are the same. I don't think there is a role to only deploy and not upgrade. You can check permissions at the following docs:
- Deployment pipelines: https://learn.microsoft.com/en-us/power-bi/create-reports/deployment-pipelines-process#permissions-table
- Workspaces: https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-roles-new-workspaces#workspace-roles
As an alternative, you could create a script for Deploy with Service Principal using the Power Bi Rest API. Let the Contributor a permission for running the script. You could use runbooks, azure functions or even local things with the secrets hidden. That way the contributor can't update the app but they could deploy with the script. You can check the request from here:
https://learn.microsoft.com/en-us/rest/api/power-bi/pipelines/selective-deploy
There are cmdlets for powershell or libraries for python like SimplePBI.
I hope that helps,
Many thanks, I had read the articles and that is what I thought but I appreciate the confirmation.
The other solution you have proposed will undoubtedly work but will add cost & complexity methinks. I think the interim solution is to give them Member access and trust them not to update the App.
I will add this as an idea too.