Roles in planning in Fabric

Planning roles provide a flexible, least-privilege access model for plan items. Instead of assigning fixed permissions, planning automatically adjusts your role based on the actions you perform. With dynamic role assignment, you start with the minimum required access and gain more capabilities only when necessary.

Planning supports three roles:

• Viewer: Has read-only access to consume and analyze plans, reference data, and dashboards. Viewers can explore data, filter information, and compare scenarios without modifying planning data or structures. This role is intended for executives and business users who consume plans, dashboards, and forecasts.
• Stakeholder: Can collaborate on plans by entering data and writing back values. Stakeholders can't permanently modify the structure of planning sheets. While they can temporarily customize layouts for analysis, planning doesn't persist these changes, and other users can't see them. This role is intended for business leads who enter data, validate assumptions, and approve plans. Stakeholders can also create and edit data apps and advanced reports.
• Planner: Acts as an author and modeler with administrative privileges and can create planning input structures. Planners can manage planning structures, configure business rules, manage writeback destinations, create forecasts and scenarios, and perform advanced planning operations. Planners can create master data, reports, and dashboards. This role is intended for FP&A teams and analysts who design models, run scenarios, and orchestrate the planning cycle.

Role permission matrix:

Roles are flexible, and planning assigns them dynamically through time-bound sessions based on your actions. Roles adapt in real time based on how you contribute, without manual role reassignment.

Relationship between Fabric workspace roles and planning roles

Fabric workspace roles and planning roles are independent and serve different purposes. Fabric workspace roles determine your ability to access and manage workspace items. Planning roles determine the actions you can perform within a plan item.

Recommended Fabric workspace role mapping:

This recommendation helps ensure that:

• Fabric enforces row-level security (RLS) and semantic model security rules correctly.
• You see only the data you have permission to access.
• Stakeholders and Viewers can't enter report edit mode.
• Planning templates and report structures stay safe from unintended modifications.

Dynamic role assignment

Planning assigns planning roles dynamically based on user activity. You typically begin in a Viewer session. As you perform actions that require extra privileges, planning automatically upgrades you to the appropriate role.

Examples:

With this dynamic model, administrators don't need to manually manage role assignments.

Upgrade roles

Upgrade your planning role by performing an action that requires Planner or Stakeholder permissions, or upgrade the role manually.

Check current role

The planning toolbar shows your assigned role. Select the role indicator to display additional information, including current session type, session expiration details, and capabilities of the current role.

Role sessions

Planning roles operate through time-bound sessions. Planning creates a session when you perform a planning action, such as opening a planning sheet.

Each session remains active for 30 days. When you perform an action that requires a higher privilege level, planning automatically creates a new session for the upgraded role. Role sessions help organizations implement least-privilege access while letting you transition between planning responsibilities.

Upgrade prompts

Administrators can control whether planning prompts users before a role upgrade occurs. To display upgrade notifications, in Workspace settings, go to Plan, and enable Prompt on Session Upgrade.

• Prompt enabled: When enabled, you receive a notification before planning upgrades the role and can choose whether to proceed.
• Prompt disabled: When disabled, role upgrades occur automatically when you perform a qualifying action. Upgrade prompts are disabled by default.

Role lifecycle

Role upgrades: Planning assigns roles dynamically based on user actions through time‑bound sessions. Role upgrades occur when you perform valid planning actions. You can upgrade roles only to a higher privilege level:

• Planning can upgrade a Viewer to a Stakeholder.
• Planning can upgrade a Stakeholder to a Planner.

Role downgrades: Planning doesn't support manual downgrades within an active session.

Session expiry: Each session automatically expires after 30 days. After the 30-day session expires, a new session begins only when you perform a new action on a plan item. The first successful action determines the persona for the new session:

• If you only open and view a plan item, the new session starts as a Viewer session.
• If you perform a Planner-level action (for example, create a new planning sheet or write back data), the new session starts as a Planner session. Each new session inherits its role from your first successful activity.

Capabilities by role

Formatting and layout

Data input, forecasting, and what-if analysis

Writeback and export

Commenting and collaboration

Build planning models

PowerTable

Intelligence

FAQs

Can I share roles across capacities?

No. Each capacity evaluates roles independently.

Can I downgrade roles?

No, planning doesn't support downgrades. You can only upgrade roles to higher privilege levels; however, your assigned role automatically expires after 30 days.

What happens when my role session expires?

The next time you interact with a plan item, planning creates a new session. Your first successful action determines the role for the new session.

Do planning roles affect Fabric workspace permissions?

No. Planning roles and Fabric workspace roles are independent security models that Fabric evaluates separately.