Today’s #TipTuesday is around the permissions required for either creating reports or publishing reports in SSRS. These are permissions as they relate to Report Builder 3.0 at least, as I haven’t tested that the exact same is true via Business Intelligence Development Studio (BIDS). I assume the same applies but haven’t tested that myself so YMMV.
Also of note: this article is purely on the permissions required in SSRS itself, I am not touching on the data side but obviously the users who are previewing data here will also require the correct access to the data depending on what your data sources are.
Permissions for “Authors”
If your organization has a hierarchy of roles, and those that write reports shouldn’t be allowed to publish to the report server, these are the permissions you’ll want to set.
At the home page level of your SSRS reports site, the user should be granted Report Builder permissions at a minimum. That allows someone to connect to that report server in Report Builder 3.0, and but not publish any report definitions back to the site. For example: if they have Report Builder permissions on a folder containing existing reports, they could open that, but would have to “Save As” elsewhere if they made changes.
Step 1: from the “home” page of your SSRS site, click on Manage Folder. This can be done by anyone who is assigned Content Manager or System Administrator in SSRS.
Step 2: assign the Report Builder role to your user or group, and click OK to save that change.
The user will be able to open that report to edit it in Report Builder 3.0 now. If the user receives this permission error below, that means they do not have at least Report Builder permission on the SSRS report server or specific folder they are attempting to open a report from. By default permissions cascade to all sub-folders but keep in mind, if anyone has overridden the default security on a folder level, this permission may need to be granted on additional folders for it to have the necessary effect.
For search engines’ sake, this error text is “Failed to open report XYZ. The permissions granted to user DOMAIN\USER are insufficient for performing this operation.”
One note: if you only grant the user Report Builder and nothing else, they will be unable to run the report (preview) in Report Builder 3.0, so the next step is relevant to Authors as well, but listed as a separate thing for clarity!
Permissions for Running (Previewing) reports
The above permission will allow someone to create reports and save locally etc. but what good is that if they can’t also preview the reports to ensure they execute? It isn’t! Here is the permission required for a user to be able to execute a report definition outside of the SSRS report server. Note: this is a tad confusing to many because the same user likely has permission to run the actual report in SSRS itself, it’s only the execution outside of SSRS that requires the specific permission change.
Step 1: Go to Site Settings on the SSRS report site (click on the gears icon). This can be done by anyone who is a System Administrator in SSRS.
Step 2: Click on Security and assign the System User role to your user or group. The System User role specifically allows use of any client application that executes report definitions (i.e. this should work for BIDS or Report Builder 3.0).
The user will be able to run/preview that report in Report Builder 3.0 now. If the user receives this permission error below, that means they do not have this permission on the SSRS report server.
For search engines’ sake, this error text is “Failed to preview report. The permissions granted to user DOMAIN\USER are insufficient for performing this operation.”
If the user does not need publishing permissions, then these 2 permission areas above would give a user sufficient access to create and preview reports in a tool like Report Builder 3.0, assuming they have a way to access to data in the report itself as well.
Permissions for Publishing reports
This last set of permissions is related to simply publishing reports to the SSRS report server. This permission actually includes the above Report Builder permissions so if your organization is less formal, and a user can do both report authoring and report publishing then this set of permissions + the System User role above will give them all that they require.
Step 1: from the “home” page of your SSRS site, click on Manage Folder. This can be done by anyone who is assigned Content Manager or System Administrator in SSRS.
Step 2: assign the Publisher role to your user or group, and click OK to save that change.
The user will be able to open that report to edit it in Report Builder 3.0 now as well as publish the report back to the report server. If the user receives this permission error below, that means they do not have at least Publisher permission on the SSRS report server or specific folder they are attempting to open a report from or publish a report to. By default permissions cascade to all sub-folders but keep in mind, if anyone has overridden the default security on a folder level, this permission may need to be granted on additional folders for it to have the necessary effect.
For search engines’ sake, this error text is “An error occurred when saving changes to report YOUR_REPORT_NAME, or to the report data sources or parameters. Verify that you have permission to save changes to this location.”
