• Article

Lesson 1: Setting System-Level Permissions on a Report Server

You can define system-level role assignments to grant access to global tasks and permissions that apply to a report server site as a whole. Each user who requires access to a report server should have a system-level role assignment. You can use the predefined roles that Report Manager provides to create the assignments:

  • Assign the System Administrator role to a small number of users who require elevated permissions on a report server, including the ability to manage permissions and roles, set defaults, manage ongoing report processes, and create shared schedules. For more information about the complete collection of system-level tasks, see System Administrator Role.

  • Assign the System User role to all other users. This role allows users to view server properties, select shared schedules, and run Report Builder reports. If you have a domain group account that defines permissions for a large number of users, you should assign that account to the System User role. For more information about the tasks in the System User role, see System User Role.

In this lesson, you will create two new role assignments: one for a large group of users who need only minimal site-level permissions, and one for a small number of users who have content management responsibilities.

This tutorial assumes that the predefined roles include the default set of tasks for each role. If you modified the task list, the roles might not include the tasks that are necessary for performing the operations described in this tutorial.

To define role assignments, you must have sufficient permissions. On a new installation of Reporting Services, you must be a member of the local Administrators group to create role assignments.

To create a system-level role assignment

  1. If necessary, log on as a local administrator.

  2. Open a browser window and type the Report Manager URL to start the application.

  3. Click Site Settings at the top of the page.

  4. Click the Security tab at the side of the page. This page shows all system-level role assignments that are currently defined. On a new report server installation, only the two predefined roles, System Administrator and System User, are visible. There is one built-in role assignment that is created automatically; it maps the built-in local administrators group to the System Administrator role

  5. Click New Role Assignment.

  6. In Group or user name, specify a domain group account that includes all of the users who require permissions to view report server content and subscribe to reports. Specify the account in this format: domain\group. The account should be in the same domain or in a trusted domain. If you do not have a domain group that fits this description, you can specify individual domain user accounts instead.

  7. Select System User.

  8. Click OK.

  9. Click New Role Assignment again.

  10. In Group or user name, type the name of a domain user account for a user who has administrative responsibilities for this report server. Specify the account in this format: domain\user. The account should be in the same domain as the report server or in a trusted domain.

  11. Click OK.

Next Steps

You have successfully created two system-level role assignments. One role assignment grants minimal system-level permissions to a domain group account. The second role assignment grants administrative permissions to a specific user account. If users access Report Manager now, they will see the global toolbar at the top of the page and menu commands, but no content. To view content, you must create additional role assignments.

Next, you will create two item-level role assignments that allow the same group and user to access folders, reports, shared data sources, report models, and resources on the report server. See Lesson 2: Setting Item-Level Permissions on a Report Server.