Role-based security
Repository roles
Repository roles provide farm-level permissions. For example, permission to manage audit logs or permission to create applications.
Application roles
Application roles enable you to define permissions across all authorization levels within an application.
You can define these types of permissions:
- Application-wide functional permission
- Access permissions for objects such as reports and dashboards
- Data access permission on cube, element, and cube cell level
Typically, application roles are used for business roles, such as Sales Manager, Controller, etc.
Data roles
Data roles enable you to define permissions on the data level only and are used in combination with application roles.
Data roles can control access at the cube, element, and cube cell level. Typically, there are many more data roles than application roles.
Depending on the setup of your application security, you could create data roles for each user in an application, or for each element in a secured dimension.
Example
Create an application role for the Sales Manager business role. All sales managers who are assigned to the Sales Manager role can view the same sales reports and dashboards and access the same sales data cubes. But each sales manager is responsible for a separate region and must only see the sales data for their region.
To achieve this, you create a data role for each region. Thus, a user with the Sales Manager role, assigned to the Region 1 data role, can see only the data for Region 1. A second user, also with the Sales Manager role, but assigned to the Region 2 data role, can see only the data for Region 2.