Roles in Fabric Plan

Planning roles provide a flexible, least-privilege access model for planning items. Instead of assigning fixed permissions, plan automatically adjusts your role based on the actions you perform. With dynamic role assignment, you start with the minimum required access and gain more capabilities only when necessary.

Plan supports three roles:

• Viewer: Has read-only access to consume and analyze plans, reference data, and dashboards. Viewers can explore data, filter information, and compare scenarios without modifying planning data or structures. This role is intended for executives and business users who consume plans, dashboards, and forecasts.
• Stakeholder: Can collaborate on plans by entering data and writing back values. Stakeholders can't permanently modify the structure of planning sheets. While they can temporarily customize layouts for analysis, plan doesn't persist these changes, and other users can't see them. This role is intended for business leads who enter data, validate assumptions, and approve plans. Stakeholders can also create and edit data apps and advanced reports.
• Planner: Acts as an author and modeler with administrative privileges and can create planning input structures. Planners can manage planning structures, configure business rules, manage writeback destinations, create forecasts and scenarios, and perform advanced planning operations. Planners can create master data, reports, and dashboards. This role is intended for FP&A teams and analysts who design models, run scenarios, and orchestrate the planning cycle.

Role permission matrix:

Roles are flexible, and plan assigns them dynamically through time-bound sessions based on your actions. Roles adapt in real time based on how you contribute, without manual role reassignment.

Relationship between Fabric workspace roles and planning roles#

Fabric workspace roles and planning roles are independent and serve different purposes. Fabric workspace roles determine your ability to access and manage workspace items. Planning roles determine the actions you can perform within a planning item.

Recommended Fabric workspace role mapping:

This recommendation helps ensure that:

• Fabric enforces row-level security (RLS) and semantic model security rules correctly.
• You see only the data you have permission to access.
• Stakeholders and Viewers can't enter report edit mode.
• Planning templates and report structures stay safe from unintended modifications.

Dynamic role assignment#

Plan assigns planning roles dynamically based on user activity. You typically begin in a Viewer session. As you perform actions that require extra privileges, plan automatically upgrades you to the appropriate role.

Examples:

With this dynamic model, administrators don't need to manually assign roles. However, they can control which users can upgrade to Planner and Stakeholder sessions. To learn more, see Control session upgrades.

Upgrade roles#

Upgrade your planning role by performing an action that requires Planner or Stakeholder permissions.

Check current role

The planning toolbar shows your assigned role. Select the role indicator to display additional information, including current session type, session expiration details, and capabilities of the current role.

Role sessions

Planning roles operate through time-bound sessions. Plan creates a session when you perform a planning action, such as opening a planning sheet. Each session remains active for 30 days. When you perform an action that requires a higher privilege level, plan automatically creates a new session for the upgraded role. Role sessions help organizations implement least-privilege access while letting you transition between planning responsibilities.

Control session upgrades#

Administrators can control which users can upgrade to Planner and Stakeholder sessions. They can also configure whether users receive a warning when creating or upgrading a session could result in capacity oversubscription.

The following tenant settings are available:

1. Users can upgrade to a Planner session
2. Users can upgrade to a Stakeholder session
3. Show Oversubscription Warning

Users can upgrade to a Planner session

This setting controls whether users can upgrade to a Planner session.

Planners can create plan items, connect semantic models, build planning sheets, and publish planning applications.

Administrators can:

• Enable or disable Planner session upgrades.
• Apply the setting to:
  • The entire organization: All users in the organization can upgrade to a Planner session.
  • Specific security groups: Only users who belong to the selected security groups can upgrade to a Planner session.

Users can upgrade to a Stakeholder session

This setting controls whether users can upgrade to a Stakeholder session.

Stakeholders can enter data, write back changes, and collaborate on published plan items in Reading view.

Administrators can:

• Enable or disable Stakeholder session upgrades.
• Apply the setting to:
  • The entire organization: All users in the organization can upgrade to a Stakeholder session.
  • Specific security groups: Only users who belong to the selected security groups can upgrade to a Stakeholder session.

Stakeholder access requirements

To upgrade to a Stakeholder session, users must either

• Belong to a security group configured for Stakeholder access, or
• Already have Planner access.

Users who do not have either type of access cannot create or edit plan items, enter data, write back changes, or collaborate. They can only access plan items in Reading view.

Show Oversubscription Warning

This setting controls whether users receive a warning when creating or upgrading a session could result in capacity oversubscription.

Administrators can:

• Enable the setting to show an oversubscription warning when applicable.
• Disable the setting to prevent the warning from being displayed.

When enabled, the warning appears before users create or upgrade a session that is likely to cause capacity oversubscription. The warning helps users understand the potential capacity impact before they proceed.

Settings Summary

Relationship Between Planner and Stakeholder Access

• Planner access includes Stakeholder access. Users with Planner access can also upgrade to a Stakeholder session
• If the administrator enables Planner access for the entire organization, it also allows all users to upgrade to a Stakeholder session.
• Administrators can grant Stakeholder access independently to specific users or security groups.

Role lifecycle#

Role upgrades: Plan assigns roles dynamically based on user actions through time‑bound sessions. Role upgrades occur when you perform valid plan actions. You can upgrade roles only to a higher privilege level:

• Plan can upgrade a Viewer to a Stakeholder.
• Plan can upgrade a Stakeholder to a Planner.

Role downgrades: Plan doesn't support manual downgrades within an active session.

Session expiry: Each session automatically expires after 30 days. After the 30-day session expires, a new session begins only when you perform a new action on a plan item. The first successful action determines the persona for the new session:

• If you only open and view a plan item, the new session starts as a Viewer session.
• If you perform a Planner-level action (for example, create a new planning sheet or write back data), the new session starts as a Planner session. Each new session inherits its role from your first successful activity.

Capabilities by role#

Formatting and layout

Data input, forecasting, and what-if analysis

Writeback and export

Commenting and collaboration

Build planning models

PowerTable

Intelligence

FAQs#

Can I share roles across capacities?

No. Each capacity evaluates roles independently.

Can I downgrade roles?

No, plan doesn't support downgrades. You can only upgrade roles to higher privilege levels; however, your assigned role automatically expires after 30 days.

What happens when my role session expires?

The next time you interact with a planning item, plan creates a new session. Your first successful action determines the role for the new session.

Do planning roles affect Fabric workspace permissions?

No. Planning roles and Fabric workspace roles are independent security models that Fabric evaluates separately.