Microsoft Fabric · Governance Domains
Domain Contributor
Contribute to a Fabric governance domain. Can assign their own workspaces to the domain and publish content into it, but cannot manage domain settings or other contributors.
Scope: Single Fabric governance domain - contribute without admin rights
Permissions
- Workspace association - Associate owned workspaces with the domain
- Domain content - Publish content to the domain
- View domain - See domain settings and membership (read-only)
Common use cases
- Workspace owners publishing data products to a shared domain
- Citizen data engineers contributing to a business unit's domain catalogue
Best practices
- Default role for workspace owners whose content belongs to a domain
- Use security groups for assignment so membership scales with team changes
- Pair with Workspace Admin training so contributors understand the cascading effect of domain assignment
Security considerations
- Domain Contributors can change the domain assignment of workspaces they admin - this affects sensitivity labels and certification policies inherited from the domain
- Promoting a workspace to a domain inherits any default sensitivity label configured for that domain - review label impact before assigning
Common questions
When should I assign the Domain Contributor role?
Assign Domain Contributor when you need to: Workspace owners publishing data products to a shared domain; and Citizen data engineers contributing to a business unit's domain catalogue. It is part of Microsoft Fabric and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Domain Contributor role do?
The Domain Contributor role grants permissions including: Workspace association - Associate owned workspaces with the domain; Domain content - Publish content to the domain; and View domain - See domain settings and membership (read-only). See the Permissions section above for the full list.
What are the security risks of the Domain Contributor role?
Key considerations when assigning Domain Contributor: Domain Contributors can change the domain assignment of workspaces they admin - this affects sensitivity labels and certification policies inherited from the domain; and Promoting a workspace to a domain inherits any default sensitivity label configured for that domain - review label impact before assigning. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.