I want to have a Fabric Workspace, but limit it to regular Power BI Workspace

[Anu66]

I want to have a Fabric Workspace, but limit it to regular Power BI Workspace i.e user shouldnt be able to access any fabric item. Basically, I want to host reports on a Workspace backed up by fabric capacity but limit it to only report deployment and viewing(similar to contributer access).  

Along with this, I am also looking for a Viewer kind of access , but restricted to only reports. As we cannot allow all business users to view our Lakehouse Data, all fabric objects (even though they cant open them).

[v-nmadadi-msft]

Hi @Anu66 ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the community members for the issue worked. If our response addressed, please mark it as Accept as solution and click Yes if you found it helpful.

Thanks ands regards

[v-nmadadi-msft]

Hi @Anu66 ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If the community members response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thanks and regards

[v-nmadadi-msft]

Hi @Anu66 ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution or get back to us. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[nilendraFabric · Accepted solution]

HI @Anu66 

You can’t configure a Fabric workspace so that it behaves exactly like a traditional “Power BI-only” workspace if it also contains Lakehouses or other Fabric items because Admin, Member, and Contributor roles can see and modify all items in that workspace.

However, there are a few approaches to hide or limit access to Fabric items while still hosting and sharing reports:

Use a separate workspace for sensitive Fabric items. Keep your Lakehouse or other Fabric objects in one workspace and store only Power BI reports (or a shared dataset reference) in a second workspace. Give your business users permissions only in the second “reports” workspace. As a result, they’ll see and interact with the reports without having any access to the Lakehouse.

Publish an app (instead of granting workspace roles). If you only need end users to view published reports, put the reports in the workspace, but don’t assign them a workspace role. Instead, publish the workspace as an app and share that app. App viewers won’t see other workspace items (like a Lakehouse), and they won’t be able to open or edit those items.
Give item-level permissions where needed.

If you must keep Lakehouses and reports in the same workspace, you can share only the report with users (either via Share > Manage Permissions or using the app) and avoid granting them a Viewer role on the Lakehouse. As long as you don’t grant “Read all” or “Build” permissions on the Lakehouse item, they won’t have direct data access

If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.

[Anonymous]

A Power BI or Fabric Admin (could be a O365 Admin or Azure Portal Admin) would have to modifiy the tenant option to either inlcude only specific users OR Excep specific users: