Deployment Pipelines permissions

[frhr]

Hi everyone,

I am trying to implement a solution using DEV and PROD workspaces, and a deployment pipeline to promote reports from DEV to PROD. When configuring the access in the pipeline, I see there is only one type of permission, Admin permissions. I don't want to give access permissions to the users, they only need the pipeline for promotion purposes. Also I have read on the documentation that a member permission (at least) is required on each stage.

My plan was to encorage the use of the deployment pipeline for promotion while keeping PROD as a only read / view workspace but it seems is not possible right now.

Any thoughts?

Thanks in advance! 

[tayloramy · Accepted solution]

Hi @frhr,

You’re reading the docs right - deployment pipelines have only one pipeline-level role and it’s Admin. Workspace permissions are separate, and to actually deploy between stages you must be a pipeline admin and have at least Contributor, Member, or Admin on the workspaces connected to those stages. Viewer isn’t enough to perform deployments. See The deployment pipelines process and Get started with deployment pipelines.

What this means for a read-only PROD:

• Keep end users as Viewers in PROD (or consume via an App).
• Create a small “Release Managers” group and give it:
  • Pipeline Admin on the pipeline, and
  • Contributor on the DEV and PROD workspaces so they can deploy but can’t publish or unpublish the App. App publishing is limited to Admins and Members, per Roles in workspaces in Power BI and Publish an app in Power BI.
• Optionally, keep a very small set of App managers as Member in PROD if you want App updates controlled separately from deployments.

If you want zero human editors in PROD: use a service principal as the deployment identity. Grant it Pipeline Admin and Contributor/Member on PROD, and remove edit roles from humans. Service principals can own and operate pipelines and workspaces; see Deployment Pipelines REST API (note the service principal prerequisites on that page).

There isn’t a built-in “deploy-only” permission or a workspace toggle that forces all edits to go through pipelines today. If you want that capability, consider voting for this idea: Make production workspace items read-only (editable only via Deployment Pipeline, Git, or API).

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, please mark this as the solution.