Hello everyone. I was wondering if anyone has any feedback on this. I need to setup permissions on a SSRS folder that we control. I am familiar with how Windows inheritance works and I need to make sure that SSRS is following that. So we have our top folder called AI - within that I will have Dept1, Dept2 and Public, etc. I will need to make sure that who has access to Dept1 DO NOT have access to Dept1 but everyone access to Public. The easiest way I guess would be to create a groups and work with inheritance. So basically create groups Dept1, Dept2 and Public and then allow all groups access to AI folder and then stop inheritance for each folder and assign each folder the correct permission for corresponding group. A question - can a user pass the top folder if he doesn't have permission? For example can a user that is not defined in Security tab of AI can access Dept1 if I grant him access only to Dept 1? Thank you. AdrianAV

No, a user cannot pass the top folder. The user will need at least Browser permission for all higher folders, including Home, to access the folder.Kathi Kellenberger Convert DTS to SSIS | Document SSIS | 30+ SSIS Tasks | Real-time SSIS Monitoring | Quick Starts | BI Blitz

Hello Kathi and thank you for your help. I think that a user is allowed to pass the top folder but only if the folder underneath has inheritance removed. I just tested a user accessing a folder under the top folder: when the inheritance was not removed and user did not have access to the top folder the final access was ACCESS DENIED. When inheritance was removed, user did not have access to the top BUT he had access to the folder below he COULD run the report - so ACCESS ALLOWED. I though is like windows share - you cannot access the folder below unless you have access from above. AV

Hi Avasile, When we grant permissions on a report manager, role assignments are typically inherited from a parent node. However, the permission inheritance will be broken if we create a new role assignment for a particular item under the parent node. As Kathi posted above, a user cannot access a particular item if the user doesnt have the access to the parent node. In this issue, you can assign the Browser role to each user for the AI folder, and then set the permission of each sub-folder based on your requirement. In addition, you can also define new Item-level roles by specifying specific tasks for the roles. References: How to: Grant User Access to a Report ServerTutorial: Setting Permissions in Reporting Services If you have any questions, please feel free to let me know. Regards, Mike Yin

Hello Mike. Thank you for your help - I guess it makes sense although it is strange having access to a subfolder if the top folder does not grant access. Anyway, thank you for your help. AdrianAV

Hi Avasile, Thanks for your posting. Thats a little curious. If you didnt set the Item-level permission for the AI folder particularly, the folder may inherit the role assignments from its parent node, for example the report manager root node (the Home page). At this time, I would like you to check that the Group or User list in security property tab of the AI folder and make sure the user is not listed there. Regards, Mike Yin

Hello Mike. This is our folder structure: Home >> AI >> Dept 1 User is not listed in either Home or AI but if I email the link he can access Dept 1. Please keep in mind that for Dept 1 folder I stopped the inheritance and add the user as Browser to that folder. AV