none
SRS Web Based Reports

    Question

  • With Config Manager 2007, we had an absolute degree of granularity. I could delegate access to an individual report for an individual user.

    However with Config Manager 2012 and RBA, we seem to have lost this degree of granularity. Or am I missing something? As far as I can tell, I can no longer give permission to a report, but have to assign a role within Config Manager for the entire report subset (i.e. all Software Update related reports).

    Any permissions set on the web based reports are overwritten by a refresh from the 2012 server.

    Is there an easier of delegating access to individual web based reports in Config Manager 2012 beyond:

    Creating a new report folder
    Setting custom permissions (these aren't overwritten by the refresh, I guess this is an oversight?)
    Copying an existing report into the above folder

    Thanks!

    Wednesday, September 18, 2013 10:54 AM

All replies

  • Two solutions :

    Edit properties of the desired report in ConfigMgr console then modify to your liking

    Edit properties of the desired folder or report in Reporting Service Web page then modify to your liking

    Hope this helps.

    • Proposed as answer by Matthias CECILLON Wednesday, September 18, 2013 11:15 AM
    • Unproposed as answer by Rashmika Wednesday, September 18, 2013 11:21 AM
    Wednesday, September 18, 2013 11:14 AM
  • Two solutions :

    Edit properties of the desired report in ConfigMgr console then modify to your liking

    Edit properties of the desired folder or report in Reporting Service Web page then modify to your liking

    Hope this helps.

    Hi, as per my OP:

    "Any permissions set on the web based reports are overwritten by a refresh from the 2012 server."

    So setting permissions on the web based reports doesn't work. It gets reset about every 15 minutes.

    Wednesday, September 18, 2013 11:23 AM
  • I am really happy with what Microsoft have done with 2012. Block selecting updates in a group is a Godsend. The fixes to delta discovery... etc etc.

    However the dumbing down of access delegation is a backwards step. As far as I can tell, Microsoft have removed the excellent level of granularity that we had in 2007 and replaced it with tick boxes and roles. Yes, that is okay, but it should be there WITH the option to delegate down to individual instances of a class.
    Wednesday, September 18, 2013 12:00 PM
  • I just tested that again and it is possible to set granular permissions using either the console or the /reports website. It's just a bit of work to do.

    Torsten Meringer | http://www.mssccmfaq.de

    Wednesday, September 18, 2013 1:53 PM
  • I just tested that again and it is possible to set granular permissions using either the console or the /reports website. It's just a bit of work to do.

    Torsten Meringer | http://www.mssccmfaq.de


    How? The reports web site has the permissions overwritten by Config Manager.

    There are no option in the 2012 console to set granular permissions, it's all role based. You cannot apply a scope to an individual report as far as I can see.
    Wednesday, September 18, 2013 1:56 PM
  • Bring up the properties of a report (using the ConfigMgr console), navigate to the "security" tab and untick "Inheriting rights from parent object". That lets you add custom rights.

    Torsten Meringer | http://www.mssccmfaq.de


    Wednesday, September 18, 2013 2:08 PM
  • Bring up the properties of a report (using the ConfigMgr console), navigate to the "security" tab and untick "Inheriting rights from parent object". That lets you add custom rights.

    Torsten Meringer | http://www.mssccmfaq.de



    Yes agreed, that gives access to a single report but not to the parent folder. Is there an option to set permissions on the parent report folders via hte console? I don't think it is possible.
    Thursday, September 19, 2013 11:08 AM
  • Yes agreed, that gives access to a single report but not to the parent folder. Is there an option to set permissions on the parent report folders via hte console? I don't think it is possible.


    It is not possible to set permission on the SSRS folder (you could try the CM12 SDK but  I haven't seen anything in there to do it) but you can set permission on each report.

    http://www.enhansoft.com/

    Thursday, September 19, 2013 11:58 AM
  • Which kinda brings me full circle to the OP. With 2007, I could set this in a few clicks.

    I guess I am stuck with:

    Creating a new report folder
    Setting custom permissions (these aren't overwritten by the refresh, I guess this is an oversight?)
    Copying an existing report into the above folder

    *sigh*

    Friday, September 20, 2013 10:53 AM
  • I believe ConfigMgr 2012 R2 will bring per-report based permissions to the party.

    My Personal Blog: http://madluka.wordpress.com

    Friday, September 20, 2013 11:19 AM
  • I believe ConfigMgr 2012 R2 will bring per-report based permissions to the party.

    My Personal Blog: http://madluka.wordpress.com

    Attaching securtity scopes to individual report or reports folders would do it for me ;)

    Then I can apply said scope to a custom report viewer role.

    Friday, September 20, 2013 11:22 AM
  • I believe ConfigMgr 2012 R2 will bring per-report based permissions to the party

    To my knowledge nothing has changes in that perspective in CM12R2. Why do you think that it has changed? Yes RBA is coming to CM12R2 and SSRS but that is not the same as report permissions.


    http://www.enhansoft.com/

    Saturday, September 21, 2013 3:18 PM
  • I believe ConfigMgr 2012 R2 will bring per-report based permissions to the party

    To my knowledge nothing has changes in that perspective in CM12R2. Why do you think that it has changed? Yes RBA is coming to CM12R2 and SSRS but that is not the same as report permissions.


    http://www.enhansoft.com/

    I din't follow you.

    Role Based Access is already in Config Manager 2012 SP1. How can it be coming with R2?

    Also, the web based report permissions are reset by Config Manager every 10 to 15 minutes, so whatever access is set via RBA is propagated to the web based reports (fourth time it's been said now :P ).
    Monday, September 23, 2013 8:28 AM
  • Role Based Access is already in Config Manager 2012 SP1. How can it be coming with R2?

    Also, the web based report permissions are reset by Config Manager every 10 to 15 minutes, so whatever access is set via RBA is propagated to the web based reports (fourth time it's been said now :P ).


    So I have confirm it I not until CM12 R2 that RBA for SSRS will be implemented.

    So what does resetting the SSRS permission every 10 minutes have to do with me question the statement about per-report based permissions?


    http://www.enhansoft.com/

    Monday, September 23, 2013 11:50 PM
  • So I have confirm it I not until CM12 R2 that RBA for SSRS will be implemented.


    As an aside I stubble across this note within the docs that also confirms that RBA now works in CM12R2.

    http://technet.microsoft.com/en-us/library/dn236351.aspx

    Configuration Manager reports are now fully enabled for role-based administration. The data for all reports included with Configuration Manager is filtered based on the permissions of the administrative user who runs the report. Administrative users with specific roles can only view information defined for their roles.”


    http://www.enhansoft.com/

    Tuesday, September 24, 2013 2:31 PM
  • Oh I see. Sorry; I don't mean any offence, but you did not state RBA and SRSS. I don't wish to nitpcik, but technically we already have RBA and web reports now. If I assign a user to a role in Config Manager that includes the Run Reports, then they can access said reports via SRSS too.

    That aside, do you mean that I could once again apply users to a Browser role for the web based reports? That would be nice...

    Permissions... yesss. Okay I'll give this another go. However this delegates access to an individual report. This is of limited use as I have to then distribute each URL direct to the report as you cannot drill down through the folder hierarchy. Still better than nowt... and as per my OP, nowhere near what we had in 2007.



    EDIT: lol you beat me to the click by a few seconds. I wrote this out earlier today :)
    • Edited by Rashmika Tuesday, September 24, 2013 2:35 PM
    Tuesday, September 24, 2013 2:33 PM