How to grant a user SSRS browser permissions on a folder without giving them access to the root

Question

When users browse to http://ssrs_server/reports, they get access denied unless they have Browser permission on the root folder. If they have Browser on folder Dept_1_Reports, they can browse successfully to http://ssrs_server/Reports/browse/Dept_1_Reports though. This is not a great user experience as they will not have a way to get to their reports with knowing the folder name. Granting Browser permission on the root folder is a big security problem as any new folders will inherit this permission, inadvertently granting users access to reports that they should not have. This seems like a design flaw - the 'landing page' of SSRS should show the user all folders that they have access to and show them. Am I missing something? This is SSRS 2017

Answer 1

You can do this, almost...

I had a similar situation but now have a setup where users can see all folders but cannot see reports within those folders unless authorised.

The trick is to create a new role.

I called mine 'FolderBrowserOnly'

To do this, open SSMS, connect to your Reporting Services Server

Expand the security folder and roles folder, then add a new role.

Set the properties so the role only has 'View Folders' permissions.

Now go back to your SSRS portal, go to the root folder and choose manage folder from the menu.

Set the user(s) role to 'FolderBrowserOnly' as required.

You can then set the normal 'Browser' role for specific users in specific folders.

There may be a better way of doing this but this worked for me.

Note This was done using SSRS 2016 but I think it will be very similar for 2017