SSRS 2016 - Remove New Button in My Reports for Users with Browser Only Role

Question

I have enabled the My Reports feature on our SSRS 2016 server because I wanted to utilize this feature for developers and for users to save shortcuts to linked reports etc. I was very cautious to make sure that all editing and designer permissions was turned off on the home folder for these regular users. Regular users are assigned the Browser permission only.

After enabling the my reports feature, users can now create datasets, data sources and paginated reports within in their folder despite not having any designer permissions in the folder or site settings. After doing research, it seems this is by design and cannot be turned off. Why would Microsoft do this? In the majority of applications, users on a corporate network would not need the ability to build reports, SSRS is a report repository for users to run reports. Regular users should not have to be confronted with the options for features they are not supposed to use. I mean, why would I want users trying to build datasets and connections strings unless they are part of the Report development staff? Is there a way to turn this feature off for the Browser permission users?

Thanks

{EDIT].
I want to add that the standard users are not assigned any system/site permissions and do not have any permissions specifically set on the Users folder or their My Reports folder. The only Permission they have assigned is the Browser Role set on the Home folder.

Answer 1

Hi @Phill ,
The My Reports feature allocates personal storage in the report server database so that users can save reports that they own in a private folder. As a report server administrator, you can enable or disable this feature or change how the feature works by modifying the security settings that control what users can do with this workspace.

The role definition used for My Reports determines what actions are supported in the My Reports workspace. For example, if the My Reports role excludes "Create linked reports," users cannot create linked reports in the My Reports folders. For more information, see Secure My Reports.

Reserving the My Reports role for the My Reports feature can help you maintain a consistent experience for users.

In short, if you want to turn this feature off for the Browser permission users, you could set the Browser Role for the "My Report" folder of those users.
Best Regards,
Joy

---

If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
What can I do if my transaction log is full?--- Hot issues November
How to convert Profiler trace into a SQL Server table -- Hot issues November

Answer 2

Joy,

I don't think the Role option under the Enable My Reports check box works quite how you think it does.
See below.

![41571-sql2016.jpg][1]

Based on my testing, the text should read "Select the role to apply to each users My Reports folder regardless of the users actual permissions"

What ever role you select in this box applies to every user irrespective of the permissions associated with their user ID.

To recreate this issue, try the following.

1. Change the option to Browser.
2. Restart The SSRS Service
3. Open SSRS portal as an Admin User
4. Open the "Users folders" and then delete a users My Reports folder who has editing/design permissions on the site.
5. Login to the SSRS portal as the same user whos folder you just deleted.
6. Open the My reports folder. - the option to add new reports etc is gone despite this user having design permissions. The Browser role has been imposed on every new My Reports folder that is created regardless of the users actual permissions.

it's a one setting applies to everyone concept that doesn't work in a business environment. I don;t understand why the featurew ould be written this way because there are always going to be some users who should be able to add new reports and some users who should not. So as it stands, the feature as it's currently working doesn't make sense to me.