Skip to content

Latest commit

 

History

History
166 lines (99 loc) · 7.44 KB

data.md

File metadata and controls

166 lines (99 loc) · 7.44 KB
Raw
title redirect_from
Data permissions
/docs/latest/administration-guide/data-permissions

Data permissions

This page covers permissions for databases and tables. If you haven't already, check out our Permissions overview.

Setting permissions on a database, schema, or table

To set data permissions on a database, schema, or table for a group:

  1. Hit Cmd/Ctrl + K. Search for Permissions and click on the Permissions settings result. Metabase will default to the Data tab.

Or

  1. Click on the gear icon in the upper right.

  2. Select Admin settings.

  3. Click on the Permissions tab, which defaults to the Data tab.

You can view permissions either by group or by database.

Data permission types

You can set the following types of permissions on a database, schema, or table:

View data permissions

The View data permission determines what data people can see. Permission levels include:

For which questions, models, and dashboards a group can view, instead see collection permissions.

Can view data permission

Setting to Can view means the group can view all the data for the data source, provided they have collection permissions to view questions, models, and dashboards.

In order to view the data in the Browse databases section, the group would additionally need to be able to Create queries.

Granular view data permission

{% include plans-blockquote.html feature="Granular view data permission" %}

This option lets you set View data permissions for individual schemas or tables. Available only for databases and schemas. If you select Granular for a database or schema, Metabase will open that data source and ask you to set permissions for each individual schema or table.

For tables, you have the option to set either Can view or Sandboxed.

Sandboxed view data permission

{% include plans-blockquote.html feature="Sandboxed view data permission" %}

Allows you to set row-level permissions based on user attributes.

See Data sandboxes.

Impersonated view data permission

{% include plans-blockquote.html feature="Impersonated view data permission" %}

The Impersonated option lets you use a role in your database to specify what data people can view and query. Impersonation can only be set at the database level, as Metabase will defer to the permissions granted to the database role.

See impersonated view data permissions

Blocked view data permission

{% include plans-blockquote.html feature="Blocked view data permission" %}

Blocked ensures people in a group can’t see the data from this database, regardless of their permissions at the collection level.

The Blocked view data permission can only be set at the database level.

Essentially, what Block does is make collections permissions insufficient to view a question. For example, even if a question is in a collection that the group has access to, but that question queries a data source that is blocked for that group, people in that group won't be able to view that question unless they're in another group with the relevant data permissions.

If a person in a blocked group belongs to another group that does have View data access to the data source, that more privileged access will take precedence (overruling the block), and they'll be able to view that question.

Create queries permissions

Specifies whether people can create new questions based on the data source. Creating queries includes the ability to drill-through and filter questions, or anything that involves changing the results.

To enable Create queries permissions for a group, that group must be able to view the data source ("Can view" permission.)

Create query levels include:

Query builder and native create queries permission

People can use Metabase's query builder or its native/SQL editor.

Query builder only create queries permission

People can create new questions and drill-through existing questions using Metabase's query builder.

Granular

The granular option lets you define Create queries permissions for each schema and/or table in the database.

Download results permissions

{% include plans-blockquote.html feature="Download permissions" %}

You can set permissions on whether people in a group can download results (and how many rows) from a data source. Options are:

  • No (they can't download results)
  • Granular (you want to set access for individual tables or schemas)
  • 10 thousand rows
  • 1 million rows

Manage table metadata permissions

{% include plans-blockquote.html feature="Data model permissions" %}

You can define whether a group can edit table metadata. Options are:

  • Yes (meaning, they can edit metadata for that data source).
  • No
  • Granular (to set permissions specific to each table).

Manage database permissions

{% include plans-blockquote.html feature="Database management permissions" %}

The Manage database permission grants access to the settings page for a given database (i.e., the page at Admin settings > Databases > your database).

On the database settings page, you can:

Note that only admins can delete database connections in your Metabase, so people with Manage database permissions won't see the Remove database button.

Revoke access even though "All Users" has greater access

If you see this modal pop-up, Metabase is telling you that the people in the All Users group (that is, everyone in your Metabase), have a higher level of access to the database, schema, or table that you're setting permissions on. To limit your current group to your preferred permission level, the All Users group must have a less permissive level of access to the data source in question.

Further reading