Roles in Fabric Plan

Planning roles provide a flexible, least-privilege access model for planning items. Instead of assigning fixed permissions, plan automatically adjusts your role based on the actions you perform. With dynamic role assignment, you start with the minimum required access and gain more capabilities only when necessary.

Plan supports three roles:

• Viewer: Has read-only access to consume and analyze plans, reference data, and dashboards. Viewers can explore data, filter information, and compare scenarios without modifying planning data or structures. This role is intended for executives and business users who consume plans, dashboards, and forecasts.
• Stakeholder: Can collaborate on plans by entering data and writing back values. Stakeholders can't permanently modify the structure of planning sheets. While they can temporarily customize layouts for analysis, plan doesn't persist these changes, and other users can't see them. This role is intended for business leads who enter data, validate assumptions, and approve plans. Stakeholders can also create/edit data apps and advanced reports.
• Planner: Acts as an author and modeler with administrative privileges and can create planning input structures. Planners can manage planning structures, configure business rules, manage writeback destinations, create forecasts and scenarios, and perform advanced planning operations. Planners can create master data, reports, and dashboards. This role is intended for FP&A teams and analysts who design models, run scenarios, and orchestrate the planning cycle.

Role permission matrix:

Roles are flexible, and plan assigns them dynamically through time-bound sessions based on user actions. Roles adapt in real time based on how users contribute, without manual role reassignment.

Relationship between Fabric workspace roles and planning roles #

Fabric workspace roles and planning roles are independent and serve different purposes. Fabric workspace roles determine your ability to access and manage workspace items. Planning roles determine the actions you can perform within a planning item.

Recommended Fabric workspace role mapping:

This recommendation helps ensure that:

• Fabric enforces Row-Level Security (RLS) and semantic model security rules correctly.
• Users see only the data they have permission to access.
• Stakeholders and Viewers can't enter report edit mode.
• Planning templates and report structures stay safe from unintended modifications.

Dynamic role assignment #

Plan assigns planning roles dynamically based on user activity. Users typically begin in a Viewer session. As users perform actions that require extra privileges, plan automatically upgrades them to the appropriate role.

Examples:

With this dynamic model, administrators don't need to manually manage role assignments.

Upgrade roles#

Upgrade your planning role by performing an action that requires Planner or Stakeholder permissions, or upgrade the role manually.

Check current role

The planning toolbar displays your assigned role. Select the role indicator to display additional information, including current session type, session expiration details, available upgrade options, and capabilities of higher privilege levels.

Role sessions

Planning roles operate through time-bound sessions. Plan creates a session when you perform a planning action, such as opening a planning sheet. Each session remains active for 30 days. When you perform an action that requires a higher privilege level, plan automatically creates a new session for the upgraded role. Role sessions help organizations implement least-privilege access while letting users transition between planning responsibilities.

Manual role upgrades

Although plan assigns roles automatically based on user actions, users can also manually upgrade their role.

To manually upgrade:

1. Select the current role indicator.
2. Review the capabilities available in the higher role.
3. Select the desired upgrade option.
4. Confirm the upgrade request.

After approval, plan creates a new role session with the corresponding permissions.

Upgrade prompts

Administrators can control whether plan prompts users before a role upgrade occurs. To display upgrade notifications, in Workspace settings, go to Plan, and enable Prompt on Session Upgrade.

• Prompt enabled: When enabled, users receive a notification before plan upgrades the role and can choose whether to proceed.
• Prompt disabled: When disabled, role upgrades occur automatically when you perform a qualifying action. Upgrade prompts are disabled by default.

Role lifecycle

1. Role upgrades: Plan assigns roles dynamically based on user actions through time‑bound sessions. Role upgrades occur when you perform valid plan actions or apply a manual upgrade. You can upgrade roles only to a higher privilege level:
   • A Viewer can be upgraded to a Stakeholder.
   • A Stakeholder can be upgraded to a Planner.
2. Role downgrades: Plan doesn't support manual downgrades within an active session.
3. Session expiry: Each session automatically expires after 30 days. After the 30-day session expires, a new session begins only when the user performs a new action on a plan item. The persona for the new session is determined based on the first successful action performed:
   • If you only open and view a plan item, the new session starts as a Viewer session.
   • If you perform a Planner-level action (for example, creating a new plan item or entering edit mode on a valid item), the new session starts as a Planner session. Each new session inherits its role from your first successful activity.

Fabric planning roles#

Formatting and layout

Data input, forecasting, and what-if analysis

Writeback and export

Commenting and collaboration

Build planning models

PowerTable

Intelligence

FAQs #

Q: Can you share roles across capacities?

A: No. Each capacity evaluates roles independently.

Q: Can I manually change my role?

A: Plan automatically assigns roles based on your actions. To upgrade a role, select the role and then select the Upgrade session button.

Q: Can you downgrade roles?

A: No, plan doesn't support downgrades. You can only upgrade roles to higher privilege levels; however, your assigned role automatically expires after 30 days.

Q: What happens when my role session expires?

A: The next time you interact with a planning item, plan creates a new session. Your first successful action determines the role for the new session.

Q: Do planning roles affect Fabric workspace permissions?

A: No. Planning roles and Fabric workspace roles are independent security models that Fabric evaluates separately.