Today's #TipTuesday is around the permissions required for either creating reports or publishing reports in SSRS. These are permissions as they relate to Report Builder 3.0 at least, as I haven't tested that the same is true via Business Intelligence Development Studio (BIDS). I assume the same applies but haven't tested that myself so YMMV.

Also of note: this article is purely on the permissions required in SSRS itself, I am not touching on the data side but obviously, the users who are previewing data here will also require the correct access to the data depending on what the data sources are.

Permissions for "Authors"

If the organization has a hierarchy of roles and those who write reports shouldn't be allowed to publish to the report server, these are the permissions admins will want to set.

At the home page level of the SSRS reports site, the user should be granted Report Builder permissions at a minimum. That allows someone to connect to that report server in Report Builder 3.0, and not publish any report definitions back to the site. For example: if they have Report Builder permissions on a folder containing existing reports, they could open that but would have to "Save As" elsewhere if they made changes.

Step 1: from the "home" page of the SSRS site, click on Manage Folder. This can be done by anyone who is assigned as a Content Manager or System Administrator in SSRS.

SSRS landing page with an arrow pointing to Manage Folder.

Step 2: assign the Report Builder role to a user or group, and click OK to save that change.

SSRS role assignment window shows the out-of-the-box roles with Publisher and Report Builder highlighted.

The user will be able to open that report to edit it in Report Builder 3.0 now. If the user receives this permission error below, that means they do not have at least Report Builder permission on the SSRS report server or specific folder they are attempting to open a report from. By default permissions cascade to all sub-folders but keep in mind, if anyone has overridden the default security on a folder level, this permission may need to be granted on additional folders for it to have the necessary effect.

Error message "Failed to open report <xxx>. The permissions granted to user <xxx> are insufficient for performing this operation."

One note: if I only grant the user Report Builder and nothing else, they will be unable to run the report (preview) in Report Builder 3.0, so the next step is relevant to Authors as well, but listed as a separate thing for clarity!

Permission for Running (Previewing) reports

The above permission will allow someone to create reports and save them locally etc. but what good is that if they can't also preview the reports to ensure they execute? It isn't! Here is the permission required for a user to be able to execute a report definition outside of the SSRS report server. Note: this is a tad confusing to many because the same user likely has permission to run the actual report in SSRS itself, it's only the execution outside of SSRS that requires the specific permission change.

Step 1: Go to Site Settings on the SSRS report site (click on the gears icon). This can be done by anyone who is a System Administrator in SSRS.

SSRS screenshot with an arrow pointing to the Site Settings option in the menu under gears.

Step 2: Click on Security and assign the System User role to the user or group. The System User role specifically allows the use of any client application that executes report definitions (i.e. this should work for BIDS or Report Builder 3.0).

SSRS Site Settings window showing 3 out-of-the-box roles.

The user will be able to run/preview that report in Report Builder 3.0 now. If the user receives this permission error below, that means they do not have this permission on the SSRS report server.

Error: "Failed to preview report. The permissions granted to user DOMAIN\USER are insufficient for performing this operation."

If the user does not need publishing permissions, then these 2 permission areas above would give a user sufficient access to create and preview reports in a tool like Report Builder 3.0, assuming they have a way to access the data in the report itself as well.

Permission for Publishing reports

This last set of permissions is related to simply publishing reports to the SSRS report server. This permission includes the above Report Builder permissions so if our organization is less formal, and a user can do both report authoring and report publishing then this set of permissions + the System User role above will give them all that they require.

Step 1: from the "home" page of the SSRS site, click on Manage Folder. This can be done by anyone who is assigned the Content Manager or System Administrator role in SSRS.

SSRS landing page again shows the arrow pointing to the Manage Folder option.

Step 2: assign the Publisher role to a user or group, and click OK to save that change.

SSRS role assignment window is shown again.

The user will be able to open that report to edit it in Report Builder 3.0 now as well as publish the report back to the report server. If the user receives this permission error below, that means they do not have at least Publisher permission on the SSRS report server or specific folder they are attempting to open a report from or publish a report to. By default permissions cascade to all sub-folders but keep in mind, if anyone has overridden the default security on a folder level, this permission may need to be granted on additional folders for it to have the necessary effect.

Error "An error occurred when saving changes to report <myreport>, or to the report data sources or parameters. Verify that you have permission to save changes to this location."