We have CI/CD enabled for our Synapse environment, which automatically validates and deploys ARM templates to the target environments when master branch is updated.

As such, we want to be able to prevent users from manually publishing within the workspace via the ‘Publish’ button.

This can easily be done via a dedicated setting within the git configuration for Data Factory, but no such option exists in Synapse.

What is the easiest way to disable this button, but continue to allow users to create, modify and remove datasets, pipelines, linked services etc. as normal?

I explored setting up a custom RBAC role for this purpose, but its not clear which specific permission governs this, and as mentioned, looked for a way to toggle this within the workspace settings but no such setting seems to exist.