How user restrictions work
A user restriction is applied to one database at a time i.e., a user could have access to cost of sales in one database, and not another. You can define separate restrictions for a number of database. Any user restriction you apply will override whatever default database restrictions are in place.
How to add or remove a restriction
User restrictions are applied using the restrictions form, which is accessed from the following locations:
- Database view on the main Users screen (single user)
- the User maintenance form (single user)
- the Import or bulk update form (multiple users).
By default, a user has access to all streams and measures in a database, unless default database restrictions prevent access. Unticking an element in the restrictions form removes it from the user's view, and the change is applied as soon as you Save (i.e., the next query the user performs on that database will exclude the restricted dataset).
A single user restriction form is accessed by selecting the lock as shown in the image below.
Restrict access to streams
At least one stream must remain available to the user. Below, access to 'Budgets' has been removed, while 'Sales' remains.
Effect on stream mode
Note that if the number of streams is reduced to one, stream mode will not be available.
Restrict access to measures
It is common for administrators to want to prevent users from seeing information relating to profit. In the example below, 'Cost', 'Profit' and 'Margin' measures have been unticked in the restrictions form.
Restrict access to dimensions
When removing access to dimensions, at least one dimension must remain available to the user. Rather than removing access to an entire dimension, it is more common to restrict access to a subset of data within a dimension.
Restrict access to part of a dimension
You can apply a filter, or multiple filters, to control access to properties and values within a dimension.
In the image below, the 'Sales Rep' dimension has been selected. Use the green plus button to add a filter.
- Use 'Code' to select properties to which you will apply the filter.
- Use 'Equal To' to select any values included in the filter.
- Any value can be manually entered in the filter entry field. Selecting 'more' displays a list of values. Multiple values can be entered, separated by semi-colons (for example, 'AG;GH;KJ' would include the three values AG, GH and KJ).
- Multiple filters can be created using a combination of the And/Or button, so you could create a filter that says 'Rep Code equals 001 or Rep Name equals FRED'. However, you can only specify filters against a single dimension (you cannot, for example, say 'Rep equals 001 OR Depot equals SE').
Restrict a user's access to more than one database
A restriction applies to a single database only, i.e., a restriction in one database has no influence on the other databases a user has access to; they could have access to cost of sales in one, and not another.
To apply restrictions to more than one database, you need to define a new restriction for each database.
Increase a user's access to data
To allow a user to access more data within a database, simply tick the entity you want to display. This will override any default restrictions applied to that database.
Restrictions and shared dashboards or favorites
Note that updating user restrictions for individual or multiple users may remove some external links to dashboards or favorites. These links are generated by dashboard or favorite owners with 'external links' permission, who want to share a view-only version with someone who doesn't have a login.
When you change restrictions you will see a warning about this before confirming the change. For example, in the image below Joe's restrictions are about to be changed.
The warning is not related to a specific link, but is more of a generic warning to allow you to check whether Joe has any external links that may be affected before you confirm.