Global Report Restrictions provides a site-wide interface for defining global restrictions to the report data visible to a user or group of users.
It allows you to control what a user is able to see when viewing a report, allowing you to limit it to records relating to just users in selected audiences, positions, hierarchies, or even individual users. Restrictions are applied to all reports by default but can also be enabled or disabled on a report by report basis. Uses include:
This provides more fine-grained control over the specific user records that can be accessed than using content restrictions and avoids the need to configure content restrictions in every individual report.
Global Report Restrictions only apply to records that 'belong' to a specific user, for example a course completion record or an issued badge record. They are not applied to report sources where the individual records are not linked to a specific user such as the 'Course' report which just lists courses by name.
Global Report Restrictions is disabled by default. To enable Global Report Restrictions:
Turning this feature on can have a significant impact on performance.
The following settings under Site administration > Reports > Report builder > General settings apply once Global Report Restrictions is enabled:
Once the restriction has been created you can then specify which records can be viewed in reports this restriction is applied to.
You can toggle between:
To restrict which records can be viewed:
In the View records related to tab in the Assigned groups section of the page, select the Assign User Group dropdown menu.
|You can select from the following options: Audience, Position, Organisation, or Individual Assignment depending on your requirements.|
As user groups are selected and specified, the Assigned users section of the page is dynamically updated to display the individual users selected. Only records that 'belong' to these specific users will be displayed in reports applying this restriction.
In the case of groups (Audience, Position, Organisation) of users the 'Assigned users' list will be updated dynamically to reflect changes of group membership. If a user falls out of an assigned group their records will no longer be visible via this restriction.
The Users allowed to select restriction tab allows you to specify which users are assigned to the restriction.
Users assigned to a single restriction will have the restriction applied when viewing globally restricted reports and the report data will be limited to the records as defined in the View records related to tab of the restriction.
Users assigned to multiple restrictions will be notified of which restriction has been applied to a report being viewed and will have the option to change which restrictions are applied. They can select among any of the active restrictions they have been assigned to but they must always select at least one restriction to be applied. See Viewing reports with active global report restrictions below.
You can toggle between:
To restrict which users are assigned to and can apply this restriction:
In the case of groups (Audience, Position, Organisation) of users the Assigned users list will be updated dynamically to reflect changes of group membership. If a user falls out of an assigned group they can no longer apply the restriction and may have access to more data than before.
Review the Assigned users to ensure the correct user limiting selections have been set.
Go to Site administration > Reports > Report builder > Global report restrictions, or, from within editing a given restriction, click All Restriction to return to the Global report restrictions main page.
Here you can activate or deactivate any global restrictions.
|Multiple global report restrictions can be added to a site and activated or deactivated when required.|
By default these restrictions will now be active on all new reports that you create. When active this will restrict access to reports based on the configuration of the restrictions. Groups can then be added or removed at any time based on requirements.
Once Global report restrictions have been enabled and a restriction has been created, these restrictions can then be applied to any existing report which supports global report restrictions.
If the user viewing a globally restricted report is only assigned to a single restriction, the report is simply displayed with the report data being limited by the settings under the View records related to tab of the assigned restriction.
The Viewing records restricted by information box is hidden if the user has zero or one active restriction(s) or if global restrictions are not being applied to the report.
If the user viewing a globally restricted report is assigned to multiple restrictions, the report is displayed along with a Viewing records restricted by box specifying which restriction has been applied to the data being displayed and giving the user the option to change the applied restriction.
When both global and per-report content restrictions are both applied, they are combined using AND logic (e.g. a record is only shown if it matches both restrictions).
If you want to expose both global and content restricted views separately to the same user you must create two separate reports.
Report caching support for global report restrictions is not currently available.
The Totara Academy has a whole course dedicated to using Reports in Totara Learn. Here you can learn more on how to use reports, see best practice, and give it a go yourself.