Dashboard permissions
Summarize
Summary of Dashboard Permissions
Dashboard permissions in ServiceNow are managed through the Sharing pane and involve granular view and edit access. Users can create and share dashboards based on their roles, with specific access controls governing how dashboards can be modified and viewed. Understanding these permissions is crucial for effective dashboard management and data visibility.
Show less
Key Features
- Roles and Permissions: Users can create dashboards and share them with others. Access is determined by their role, with specific roles like admin and dashboardadmin having comprehensive management capabilities.
- Access Control Lists (ACLs): ACLs apply to most widgets and determine visibility based on user permissions. If a user lacks permissions for a widget, an empty placeholder appears.
- Performance Analytics: Users with papoweruser, paadmin, or admin roles can add Performance Analytics widgets to dashboards, which display real-time data based on user roles and permissions.
- Domain Separation: This may impact the ability of users to edit shared dashboards, depending on their roles.
Key Outcomes
By effectively managing dashboard permissions, ServiceNow customers can ensure appropriate access to data visualizations while maintaining security. Users can expect:
- Controlled access to sensitive data through role-based permissions.
- The ability to create and manage dashboards tailored to user needs.
- Enhanced collaboration through sharing capabilities, while maintaining oversight on who can access or edit dashboards.
Dashboards have special granular view and edit permissions that are managed from the Sharing pane. Access control lists (ACLs) apply to most widgets that are added to dashboards.
- Users with any role can create dashboards, share dashboards that they own with users and groups, and edit dashboards if they have been given edit permissions. Users with any role can restrict access by role to any dashboard that they have created. The user also needs whatever roles are necessary to access the specific data on the dashboards.
- Users without a role can view dashboards that have been shared with them, but cannot create or edit dashboards.
- Users with pa_admin and pa_power_user roles can manage users, groups, and roles on any dashboard that they can edit. For more information, see Performance Analytics roles.
- Users with the dashboard_admin or admin role can edit and manage users, groups, and roles for any dashboard. Admin and dashboard_admin users can also change a dashboard owner at any time.
- Only a dashboard owner and users with the dashboard_admin or admin role can delete that dashboard.
- The ability of users to share dashboards may be limited by the administrator. For more information, see Responsive dashboard properties.
- If Explicit Roles are activated, dashboards are treated as internal resources. Users with the snc_external role cannot view dashboards by default. For more information, see Explicit Roles.
- Domain separation can affect the ability of users to edit dashboards that have been shared with them. For more information, see Domain separation and responsive dashboards.
| View | Create | Edit | Share | Delete | |
|---|---|---|---|---|---|
| No role | Only dashboards that have been shared with them. | No | No | No | No |
| Any role | Dashboards that they create and that have been shared with them. | Yes | Only dashboards they have created or that have been shared with them with edit rights. Cannot add or remove Performance Analytics widgets without at least pa_power_user rights. | Only dashboards they have created and only with users and groups. The ability of users to share dashboards may be limited by the administrator. For more information, see Responsive dashboard properties. | Only dashboards they own or have created. |
| admin | All | Yes | Edit and manage dashboard owners, users, groups, and roles for any dashboard. | Yes | Any dashboard |
| dashboard_admin | All | Yes | Edit and manage dashboard owners, users, groups, and roles for any dashboard. | Yes | Any dashboard |
| pa_admin | Dashboards that they create and that have been shared with them. | Yes | Only dashboards they have created or that have been shared with them with edit rights. Can add or remove Performance Analytics widgets. | Only dashboards they have created and only with users and groups. The ability of users to share dashboards may be limited by the administrator. For more information, see Responsive dashboard properties. | Only dashboards they own or have created. |
| pa_power_user | Dashboards that they create and that have been shared with them. | Yes | Only dashboards they have created or that have been shared with them with edit rights. Can add or remove Performance Analytics widgets. | Only dashboards they have created and only with users and groups. The ability of users to share dashboards may be limited by the administrator. For more information, see Responsive dashboard properties. | Only dashboards they own or have created. |
| Dashboard owner | Yes | N/A | Yes | Yes. The ability of users to share dashboards may be limited by the administrator. For more information, see Responsive dashboard properties. | Only dashboards they have created. |
Widget ACLs apply when that widget is added to dashboards (except for Performance Analytics widgets). If a user can view a dashboard but does not have ACLs to view one of its widgets, an empty widget placeholder is displayed. ACLs do not apply to data visualizations that aggregate data, such as pie or bar reports. ACLs always apply to list data that is displayed in widgets. Rows in a list that a user does not have access to are not displayed.
However, if a Performance Analytics widget displays real-time scores, the score each logged-in user sees depends on their roles and the ACLs of the facts table. For more information, see Real-time scores.
The Restrict to role field on the dashboard properties form and dashboard group permissions may have an impact on dashboard permissions. The dashboard owner, and users with pa_power _user, pa_admin, or admin roles can change dashboard properties. Users with the pa_power_user, pa_admin, and admin roles can change dashboard group permissions.