Forum Discussion
Translytical task flow — Viewer role cannot trigger data function button, Member role works
Hi all,
I've built a translytical task flow into a Power BI report (comment + flag write-back via Fabric User Data Functions) and I'm stuck on a permissions issue that I can't explain. Hoping someone has seen this before.
Setup
- Workspace A (Fabric capacity, F4): contains the User Data Function and the Fabric SQL database it writes to
- Workspace B (Power BI Pro workspace, shared capacity): contains the report and the semantic model
- The report uses data function buttons that call the UDF in Workspace A. Storage mode of the semantic model is Mixed. For the writeback I am using DirectQuery.
Permissions of the affected user
- Workspace A (Fabric): Contributor, with Read, Write and Execute on the User Data Function item
- Workspace B (report): Viewer
The problem
With Viewer role in Workspace B, the user cannot execute the data functions from the report. The user gets an error, saying the writeback was unsuccessfull.
As soon as I change that same user to Member in Workspace B, everything works as expected. Nothing else changes.
What I have already ruled out
- UDF item permissions: The user is Contributor in the Fabric workspace and explicitly has Execute Functions on the UDF, so this isn't the classic "function not shared" case.
- Capacity: Capacity is identical regardless of workspace role, so the fact that the report sits in a Pro workspace shouldn't produce a Member/Viewer difference. But I'd like this confirmed.
- The tenant setting for User Data Functions is enabled, the function is published, and it returns the datatype accordingly.
My questions
1. Is there a documented or known requirement that the report workspace must also be on Fabric capacity for translytical task flows to work for Viewers? I couldn't find anything in the docs that states this - the button configuration explicitly lets you point to a UDF in a different workspace, which suggests the cross-workspace pattern is supported.
2. Does the "Refresh the report automatically" button option require write permission on the semantic model? If so, a Viewer would fail on that step even if the write-back itself succeeded. This option is currently enabled on my buttons.
4. More generally: which permissions does a report consumer actually need on the report side (beyond Viewer) to trigger a data function? The docs cover the UDF side thoroughly but say very little about the report workspace side.
Any pointers appreciated - especially from anyone running translytical task flows in production with a Viewer audience.
Thanks!
Thank you for your responses. I have contacted Micorosft Suppoert and with their help I was able to solve the permission issues. The following has to be applied:
For a Viewer to successfully perform a writeback via a User Data Function, the following access must be granted in addition to report access:
- Consumers must be added as Viewers to the workspace(s) where the report resides, and to the workspace(s) where the database and the User Data Function reside (if different).
- They need Build permission at item level on the semantic model.
- They need Read, Write and Execute permissions at item level on the User Data Function.
- They need Read and ReadData permissions at item level on the DWH (Data Warehouse) where the writeback tables are located.
3 Replies
Hi! The "Refresh the report automatically" option on the button likely write-back permission on the semantic model, which Viewers don't have. In Power BI, triggering a semantic model refresh programmatically — even a report-level refresh initiated by a button — goes through the same permission gate as the XMLA write endpoint. Viewers are explicitly excluded from this.
This means even if your UDF executes successfully, the subsequent refresh call fails, and Power BI likely rolls the whole operation back or reports the composite action as failed. Turn off "Refresh the report automatically" first and test whether the Viewer can execute the write-back cleanly. If they can, you've confirmed this is the failure point.
What does a report-side consumer actually need?
This is poorly documented, but based on the Member vs Viewer behavior you're seeing, the likely minimum is Contributor on the report workspace, not just Viewer. Here's why:
- Viewer is a consumption-only role. It grants read access to reports and datasets but explicitly blocks any action that writes to or modifies workspace items — including triggering dataset refreshes.
- The data function button in a translytical flow is not a pure "read" action from Power BI's perspective. Even though the write goes to Workspace A, the button invocation is brokered through the report/semantic model layer in Workspace B, and that brokering apparently requires more than Viewer rights.
- Member adds the ability to interact with workspace content in write-adjacent ways, which is why it unblocks the flow.
Recommended path forward
- Disable "Refresh the report automatically" and retest with a Viewer — this isolates whether refresh permission is the failure point.
- If write-back succeeds without auto-refresh, implement a workaround: use a Power Automate flow triggered by the UDF completion to handle the refresh, since flows run under their own credentials rather than the end user's workspace permissions.
- If write-back still fails without auto-refresh, the report workspace role itself is gating UDF invocation, and you'll need to either raise affected users to Contributor or restructure so the report lives in the Fabric workspace (Workspace A) alongside the UDF.
- File a support ticket with Microsoft specifically asking for documentation on minimum report-workspace permissions for translytical task flow consumers — this gap in the docs is real and worth getting a written answer on
Can you also confirm that the user does have the execute permission on the Taskflow?
Thank you for your responses. I have contacted Micorosft Suppoert and with their help I was able to solve the permission issues. The following has to be applied:
For a Viewer to successfully perform a writeback via a User Data Function, the following access must be granted in addition to report access:
- Consumers must be added as Viewers to the workspace(s) where the report resides, and to the workspace(s) where the database and the User Data Function reside (if different).
- They need Build permission at item level on the semantic model.
- They need Read, Write and Execute permissions at item level on the User Data Function.
- They need Read and ReadData permissions at item level on the DWH (Data Warehouse) where the writeback tables are located.
