> For the complete documentation index, see [llms.txt](https://docs.aidi.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aidi.ai/mosaic/user-access/workspace-roles.md).

# Workspace Roles

What each workspace role — Owner, Editor, Viewer — can do.

Every member of a workspace has exactly one role: **Owner**, **Editor**, or **Viewer**. The role applies to that workspace only - a user can be an Owner of one workspace and a Viewer of another.

## What each role can do

<table><thead><tr><th width="120">Role</th><th>What they can do</th></tr></thead><tbody><tr><td><strong>Owner</strong></td><td>Everything an Editor can, plus: invite members, change member roles, remove members, archive the workspace, promote another member to Owner.</td></tr><tr><td><strong>Editor</strong></td><td>Create, edit, and delete pages, blocks, and DAX queries. Embed Power BI content from the catalog. Use built-in AI agents and any custom agents shared in the workspace. Pin AI artifacts to pages.</td></tr><tr><td><strong>Viewer</strong></td><td>Read-only. Open pages, scroll, read AI conversations. Embedded Power BI reports stay interactive (filters, slicers, drill-throughs) because that interactivity is a Power BI client feature, not a Mosaic edit. Viewers cannot create pages, run agents in the workspace, or pin AI output.</td></tr></tbody></table>

## How roles are assigned

The workspace **Owner** assigns each new member's role when they invite them - see [Adding Members to a Workspace](/mosaic/user-access/adding-members.md). Roles can be changed any time after that:

1. Open the workspace
2. **Workspace settings → Members**
3. Click the role dropdown next to a member
4. Pick a different role
5. The change is immediate

## Multiple owners

A workspace can have more than one Owner. To promote an Editor to Owner, an existing Owner changes their role in the same way as above. Removing all Owners from a workspace is not allowed - you must always have at least one.

## Power BI access vs. Mosaic role

Workspace roles control what someone can do **inside Mosaic**. They do **not** override Power BI's own access model.

A Viewer in Mosaic who has Edit access to a Power BI workspace in Power BI itself can still interact with embedded reports normally. Mosaic does not grant or revoke Power BI permissions - every Power BI call goes through the user's own Microsoft Entra identity (the On-Behalf-Of flow).

This means:

* If a user has no Power BI access, they see "no access" on embedded blocks regardless of their Mosaic role.
* If a user has Power BI Pro / PPU access plus Editor role in Mosaic, they can interact with reports and write DAX queries the same way.
* Row-Level Security defined in Power BI is preserved end-to-end.

## Personal workspaces

Every user has one **personal workspace** that's auto-provisioned on first sign-in. They are the implicit Owner. Personal workspaces cannot be shared - they're for solo work. To collaborate, create a shared workspace and invite teammates.

## What's next

* [Adding Members to a Workspace](/mosaic/user-access/adding-members.md) - invite flow
* [User Login](/mosaic/user-access/user-login.md)  first sign-in walkthrough