Deployment Pipeline permissions

[Ian_Altis]

I want to be able to assign Contributors the ability to deploy to PROD but not to create the App.  The idea is to use the PROD Workspace as Pre-Prod and the App as PROD.  

Is this possible?

Thanks,

Ian

[ibarrau · Accepted solution]

Hi. That's not possible. The role for deploy and upgrade app are the same. I don't think there is a role to only deploy and not upgrade. You can check permissions at the following docs:
- Deployment pipelines: https://learn.microsoft.com/en-us/power-bi/create-reports/deployment-pipelines-process#permissions-t...

- Workspaces: https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-roles-new-workspaces#workspace-...

As an alternative, you could create a script for Deploy with Service Principal using the Power Bi Rest API. Let the Contributor a permission for running the script. You could use runbooks, azure functions or even local things with the secrets hidden. That way the contributor can't update the app but they could deploy with the script. You can check the request from here: 

https://learn.microsoft.com/en-us/rest/api/power-bi/pipelines/selective-deploy

There are cmdlets for powershell or libraries for python like SimplePBI.

I hope that helps,

[Ian_Altis]

Many thanks, I had read the articles and that is what I thought but I appreciate the confirmation. 

The other solution you have proposed will undoubtedly work but will add cost & complexity methinks.  I think the interim solution is to give them Member access and trust them not to update the App.  

I will add this as an idea too.