Predefined Roles

Reporting Services installs with predefined roles that you can use to grant access to report server operations. Each predefined role describes a collection of related tasks. You can assign groups and user accounts to predefined roles to provide immediate access to report server operations.

How to Use Predefined Roles

1. Review the predefined roles to determine whether you can use them as is. If you need to adjust the tasks or define additional roles, you should do this before you begin assigning users to specific roles.

2. Identify which users and groups require access to the report server, and at what level. Most users should be assigned to the Browser role or the Report Builder role. A smaller number of users should be assigned to the Publisher role. Very few users should be assigned to Content Manager.

3. When you are ready to assign user and group accounts to specific roles, use Report Manager. For more information, see Grant User Access to a Report Server (Report Manager).

Predefined Role Definitions

Predefined roles are defined by the tasks that it supports. You can modify these roles or replace them with custom roles.

Scope defines the boundaries within which roles are used. Item-level roles provide varying levels of access to report server items and operations that affect those items. Item-level roles are defined on the root node (Home) and all items throughout the report server folder hierarchy. System-level roles authorize access at the site level. Item and system-level roles are mutually exclusive but are used together to provide comprehensive permissions to report server content and operations.

The following table describes the predefined roles, scope, and how they are used.

Content Manager Role

The Content Manager role is a predefined role that includes tasks that are useful for a user who manages reports and Web content, but does not necessarily author reports or manage a Web server or SQL Server instance. A content manager deploys reports, manages report models and data source connections, and makes decisions about how reports are used. All item-level tasks are selected by default for the Content Manager role definition.

The Content Manager role is often used with the System Administrator role. Together, the two role definitions provide a complete set of tasks for users who require full access to all items on a report server. Although the Content Manager role provides full access to reports, report models, folders, and other items within the folder hierarchy, it does not provide access to site-level items or operations. Tasks such as creating and managing shared schedules, setting server properties, and managing role definitions are system-level tasks that are included in the System Administrator role. For this reason, we recommend that you create a second role assignment at the site level that provides access to shared schedules.

List of Role Definitions

Content Manager Tasks

The following table lists the tasks that are included in the Content Manager role.

List of Role Definitions

Customizing the Content Manager Role

This role is intended for trusted users who have overall responsibility for managing and maintaining report server content. You can remove tasks from this definition, but doing so may introduce ambiguity into what can be managed. For example, removing the "View reports" task from this role definition would prevent a Content Manager from viewing report contents and therefore be unable to verify changes to parameter and credential settings.

The Content Manager role is used in default security. For more information, see Predefined Roles.

Publisher Role

The Publisher role is a built-in role definition that includes tasks that enable users to add content to a report server. This role is predefined for your convenience. It is not used until you create role assignments that include it. This role is intended for users who author reports or models in Report Designer or Model Designer and then publish those items to a report server.

Report definitions can include script and other elements that are vulnerable to HTML injection attacks when the report is rendered in HTML at run time. If a published report contains malicious script, any user who runs that report will accidentally cause the script to run when the report is opened. If the user has elevated permissions, the script will run with those permissions.

To reduce the risk of users accidentally running malicious scripts, limit the number of users who have permission to publish content, and make sure that users only publish documents and reports that come from trusted sources. If you are not sure whether a report definition is safe to publish, you should open the .rdl file in a text editor and search for script tags. Malicious script can be hidden in expressions and URLs (for example, a URL in a navigation action).

List of Role Definitions

Publisher Tasks

The following table lists the tasks that are included in the Publisher role.

List of Role Definitions

Customizing the Publisher Role

You can modify the Publisher role to suit your needs. For example, you can remove the "Create linked reports" task if you do not want users to be able to create and publish linked reports, or you can add the "View folders" task so that users can navigate through the folder hierarchy when selecting a location for a new item.

At a minimum, users who publish reports from Report Designer need the "Manage reports" task to be able to add a report to the report server. If the user must publish reports that use shared data sources or external files, you should also include "Manage data sources" and "Manage resources." If the user also requires the ability to create a folder as part of the publishing process, you must also include "Manage folders."

List of Role Definitions

Browser Role

The Browser role is a predefined role that includes tasks that are useful for a user who views reports but does not necessarily author or manage them. This role provides basic capabilities for conventional use of a report server. Without these tasks, it may be difficult for users to use a report server.

The Browser role should be used with the System User role. Together, the two role definitions provide a complete set of tasks for users who interact with items on a report server. Although the Browser role provides view access to reports, report models, folders, and other items within the folder hierarchy, it does not provide access to site-level items such as shared schedules, which are useful to have when creating subscriptions. For this reason, we recommend that you create a second role assignment at the site level that provides access to shared schedules.

Browser Tasks

The following table describes the tasks that are included in the Browser role definition.

List of Role Definitions

Customizing the Browser Role

You can modify the Browser role to suit your needs. For example, you can remove the "Manage individual subscriptions" task if you do not want to support subscriptions, or you can remove the "View resources" task if you do not want users to see collateral documentation or other items that might be uploaded to the report server.

At a minimum, this role should support both the "View reports" task and the "View folders" tasks to support viewing and folder navigation. You should not remove the "View folders" task unless you want to eliminate folder navigation. Likewise, you should not remove the "View reports task" unless you want to prevent users from seeing reports. These kinds of modifications suggest the need for a custom role definition that is applied selectively for a specific group of users.

List of Role Definitions

Report Builder Role

The Report Builder role is a predefined role that includes tasks for loading reports in Report Builder as well as viewing and navigating the folder hierarchy. To create and modify reports in Report Builder, you must also have a system role assignment that includes the "Execute report definitions" task, required for processing reports locally in Report Builder.

Report Builder Tasks

The following table describes the tasks that are included in the Report Builder role definition.

List of Role Definitions

Customizing the Report Builder Role

You can modify the Report Builder role to suit your needs. The recommendations are generally the same as for the Browser role: remove the "Manage individual subscriptions" task if you do not want to support subscriptions, remove the "View resources" task if you do not want users to see resources, and keep "View reports" task and the "View folders" tasks to support viewing and folder navigation.

The most important task in this role definition is "Consume reports", which allows a user to load a report definition from the report server into a local Report Builder instance. If you do not want to support this task, you can delete this role definition and use the Browser role to support general access to a report server.

List of Role Definitions

My Reports Role

The My Reports role is a predefined role that includes a set of tasks that are useful for users of the My Reports feature. This role definition includes tasks that grant administrative permissions to users over the My Reports folder that they own.

Although you can choose another role to use with the My Reports feature, it is recommended that you choose one that is used exclusively for My Reports security. For more information, see Secure My Reports.

List of Role Definitions

My Reports Tasks

The following table lists tasks that are included in the My Reports role.

List of Role Definitions

Customizing the My Reports Role

You can modify this role to suit your needs. However, it is recommended that you keep the "Manage reports" task and the "Manage folders" task to enable basic content management. In addition, this role should support all view-based tasks so that users can see folder contents and run the reports that they manage.

Although the "Set security policies for items" task is not part of the role definition by default, you can add this task to the My Reports role so that users can customize security settings for subfolders and reports.

List of Role Definitions

System Administrator Role

The System Administrator role is a predefined role that includes tasks that are useful for a report server administrator who has overall responsibility for a report server, but not necessarily for the content within it.

To create a role assignment that includes this role, use the Site Settings page in Report Manager or use the right-click commands on the report server node in Management Studio.

The System Administrator role does not convey the same full range of permissions that a local administrator might have on a computer. Rather, the System Administrator role includes operations that are performed at the site level, and not the item level. For users who require access to both site-wide operations and items stored on the report server, create a second role assignment on the Home folder that includes the Content Manager role. Together, the two role definitions provide a complete set of tasks for users who require full access to all items on a report server.

List of Role Definitions

System Administrator Tasks

The following table lists tasks that are included in the System Administrator role.

The System Administrator role is used in default security. For more information, see Predefined Roles.

List of Role Definitions

System User Role

The System User role is a predefined role that includes tasks that allow users to view basic information about the report server. It also includes support for loading a report in Report Builder. Report Builder is a client application that can process a report independently of a report server. The "Execute report definitions" task is intended for use with Report Builder. If you are not using Reporting Builder, you can remove this task from the System User role. The following table lists tasks that are included in the System User role definition.

List of Role Definitions

System User Tasks

The System User role can be used to supplement default security. You can include the role in new role assignments that extend report server access to report users. For more information, see Predefined Roles.

List of Role Definitions

See Also

Tasks

Create, Delete, or Modify a Role (Management Studio)

Grant User Access to a Report Server (Report Manager)

Modify or Delete a Role Assignment (Report Manager)

Concepts

Granting Permissions on a Native Mode Report Server

Tasks and Permissions