Report permission issues
Summarize
Summary of Report Permission Issues
This document addresses common report permission issues that can lead to users seeing less information than expected in ServiceNow reports. These issues typically arise from insufficient permissions or reports not being shared appropriately. Understanding and resolving these issues is crucial for ensuring users have access to the necessary data.
Show less
Key Features
- Report Sharing: Newly created reports are not shared by default, making them accessible only to the creator or users with admin roles. Reports can be shared with specific users, groups, or roles.
- List Report Visibility: Differences in the number of rows displayed in list reports can occur due to access control lists (ACLs) that limit visibility based on user permissions.
- Graphical Report Data: Non-list reports may show incomplete data for users based on Before Query business rules, which filter data according to user roles or permissions.
- Public Report Access: Following the upgrade to Australia, all public Core UI reports are unpublished by default. Only users with the reportadmin role can manage the visibility of these reports.
Key Outcomes
To resolve report visibility issues, report owners or administrators should share reports appropriately and adjust permissions as needed. Users should be aware that access to data is governed by specific ACLs and business rules, which may lead to variations in report outputs based on individual user roles. Finally, users can manage public access settings to enhance report security while ensuring necessary visibility for logged-in users.
There are several reasons why a report is showing less information than expected or possibly no data at all. These include insufficient permissions on the report and the report not being shared.
Report not shared
A common reason that a report may not be viewable is that the report hasn’t been shared with the users who are attempting to access it. By default, a newly created report won’t be shared and therefore inaccessible to anyone except the report creator or users with the admin role. A report can be shared with an individual user, with one or more groups, or assigned to one or more roles.
Unshared reports don’t appear in lists of reports a user has access to or in other options in which a report might be opened or selected. When users are able to see a dashboard the report has been added to, but not the report itself, a message indicates that the "Report is visible only to a specific user or group".
To correct this issue, the owner of the report (or an administrator) can share that report with the individuals who should have visibility and access to that report. You can share a report directly from the report's sharing icon. For more information, see Share a Core UI report.
List reports show fewer rows than expected
Another common issue is that fewer rows appear in list reports than the viewer expects. For example, one user sees 100 rows in a list report, but another user, viewing that same report may see fewer rows or even no rows at all. When one or more rows have been removed from the report, a message indicates the number rows removed due to security constraints.
The usual cause is that each row of a list report is first compared against any read access control lists (ACLs) defined on the report's source tables.
The ACL is considered for each list row that might be displayed in a report. For more information, see Report_view access control.
Non-list reports show incomplete data
Graphical reports (defined as any non-list type report) may show an incomplete set of data for one user, as compared to another user reviewing that same report.
This issue is caused by the fact that Before Query business rules are performed on the data from the source table before a report is generated and rendered. Business rules, found on a report's source tables, limit the data based on permissions or similar criteria. Any records that don’t fulfill the rule's criteria aren’t included in the report. Therefore, users with differing permission levels (due to group or role permissions mainly) see the same report showing different results. For more information, see Before Query business rules.
Reports no longer public
On upgrade to Australia, all public Core UI reports are unpublished to enhance security awareness and control. The glide.report.published_reports.enabled property on all Core UI reports is set to false. Users with the report_admin role can navigate to the sys_report_public table to view unpublished reports and enable the public capacity or enable sharing with logged in users inside the platform. For more information, see (Legacy) Publish a report.