Global Report Restrictions provides a site-wide interface for defining global restrictions to the report data visible to a user or group of users.
It allows you to control what a user is able to see when viewing a report, allowing you to limit it to records relating to just users in selected audiences, positions, hierarchies, or even individual users. Restrictions are applied to all reports by default but can also be enabled or disabled on a report by report basis. Uses include:
- Let an organisation view one or more reports but only see the records that belong to users of that organisation.
- Limit access to records belonging to a subset of users (such as all suspended users) to a specific group (such as site administrators), without having to modify each individual report.
This provides more fine-grained control over the specific user records that can be accessed than using content restrictions and avoids the need to configure content restrictions in every individual report.
Global Report Restrictions only apply to records that 'belong' to a specific user, for example a course completion record or an issued badge record. They are not applied to report sources where the individual records are not linked to a specific user such as the 'Course' report which just lists courses by name.
Enabling global report restrictions
Global Report Restrictions is disabled by default. To enable Global Report Restrictions:
- Go to Site administration > Advanced features.
- Check to enable Enable report restrictions.
Turning this feature on can have a significant impact on performance.
Global report restrictions general settings
The following settings under Site administration > Reports > Report builder > General settings apply once Global Report Restrictions is enabled:
- Global restriction behaviour for users with no active restrictions: Specifies what users will see when viewing a report with global restrictions enabled when they don't have any restrictions applied to them. Options are:
- Show all records: This may be used if you prefer to block all records and only display them when a restriction has been explicitly applied (default).
- Show no records: This is not applied to site administrators who are always given access to all report records.
- Enable global restrictions in new user reports: If checked (default) all newly created user reports will have global report restrictions enabled.
Creating global report restrictions
- Go to Site administration > Reports > Report builder > Global report restrictions and click the New restriction button:
- Assign a name and an optional description (you can also specify whether the restrictions will be active immediately, this can be activated later).
- Click Save changes.
This creates the restriction, saves the details specified under the General tab, and enables the View records related to and Users allowed to select restriction tabs.
Defining which records can be viewed
Once the restriction has been created you can then specify which records can be viewed in reports this restriction is applied to.
You can toggle between:
- Allow all records to be viewed with this restriction: Allowing all records to be viewed using this button, which will hide the record limiting options.
- Restrict which records can be viewed: Limiting the records that can be viewed using this button, which reveals the record limiting options.
To restrict which records can be viewed:
In the View records related to tab in the Assigned groups section of the page, select the Assign User Group dropdown menu.You can select from the following options: Audience, Position, Organisation, or Individual Assignment depending on your requirements.
As user groups are selected and specified, the Assigned users section of the page is dynamically updated to display the individual users selected. Only records that 'belong' to these specific users will be displayed in reports applying this restriction.
In the case of groups (Audience, Position, Organisation) of users the 'Assigned users' list will be updated dynamically to reflect changes of group membership. If a user falls out of an assigned group their records will no longer be visible via this restriction.
- Review the Assigned users to ensure the correct record limiting selections have been set.
Assigning users to the restriction
The Users allowed to select restriction tab allows you to specify which users are assigned to the restriction.
Users assigned to a single restriction will have the restriction applied when viewing globally restricted reports and the report data will be limited to the records as defined in the View records related to tab of the restriction.
Users assigned to multiple restrictions will be notified of which restriction has been applied to a report being viewed and will have the option to change which restrictions are applied. They can select among any of the active restrictions they have been assigned to but they must always select at least one restriction to be applied. See Viewing reports with active global report restrictions below.
You can toggle between:
- Make this restriction available to all users: Assigning to and allowing all users to apply this restriction using this button, which will hide the user limiting options.
- Restrict which users can use this restriction: Assigning to specific groups or individuals and limiting the users that can be apply the restriction using this button, which reveals the user limiting options.
To restrict which users are assigned to and can apply this restriction:
- In the Users allowed to select restriction tab in the Assigned groups section of the page, again select the Assign User Group drop-down menu and select from the available options as described above.
As user groups are selected and specified, the Assigned users section of the page is dynamically updated to display the individual users selected. Only users specified in this list can apply this restriction to reports.
In the case of groups (Audience, Position, Organisation) of users the Assigned users list will be updated dynamically to reflect changes of group membership. If a user falls out of an assigned group they can no longer apply the restriction and may have access to more data than before.
Review the Assigned users to ensure the correct user limiting selections have been set.
Viewing or activating/deactivating global report restrictions
Go to Site administration > Reports > Report builder > Global report restrictions, or, from within editing a given restriction, click All Restriction to return to the Global report restrictions main page.
Here you can activate or deactivate any global restrictions.Multiple global report restrictions can be added to a site and activated or deactivated when required.
By default these restrictions will now be active on all new reports that you create. When active this will restrict access to reports based on the configuration of the restrictions. Groups can then be added or removed at any time based on requirements.
Activate global report restrictions on an existing report
Once Global report restrictions have been enabled and a restriction has been created, these restrictions can then be applied to any existing report which supports global report restrictions.
- In Site administration > Reports > Report builder > Manage reports.
- Select any embedded or user generated report.
- Select the Content tab.
- Click the checkbox to enable Global report restrictions.
- Save changes.
Viewing user assigned to only one restriction
If the user viewing a globally restricted report is only assigned to a single restriction, the report is simply displayed with the report data being limited by the settings under the View records related to tab of the assigned restriction.
The Viewing records restricted by information box is hidden if the user has zero or one active restriction(s) or if global restrictions are not being applied to the report.
Viewing user assigned to multiple restrictions
If the user viewing a globally restricted report is assigned to multiple restrictions, the report is displayed along with a Viewing records restricted by box specifying which restriction has been applied to the data being displayed and giving the user the option to change the applied restriction.
- Clicking the change link allows the user to select one or more of the active restrictions assigned to them to be applied to the report.
- Clicking the Save button clicked refreshes the report based on the selected restriction(s).
Combining both global and per-report content restrictions
When both global and per-report content restrictions are both applied, they are combined using AND logic (e.g. a record is only shown if it matches both restrictions).
If you want to expose both global and content restricted views separately to the same user you must create two separate reports.
Report caching and global report restrictions
Report caching support for global report restrictions is not currently available.