Edit member set permissions for a business role
Business roles control Read and Write access to the business data that users work with in PerformancePoint Add-in for Excel forms and reports. In Planning Business Modeler, this business data is represented by the member sets and members that have been added to a model site.
You can specify permissions for a member set or for individual members in a member set. For example, suppose that you want only the marketing department to view the New Clients member set, but you do not want anyone to view data for Client A in the member set. For the Marketing role, you can give Read access to the New Clients member set and deny Read access to the Client A member.
You must belong to the Data Administrator or Modeler role to change the permissions for a member set. Before you modify member set permissions, you should read the following information:
To access business data, business roles must grant Read permissions to at least one member in every member set in models that the role can access. For more information about this requirement, see Best practices for business roles.
Users who belong to multiple roles may have permissions that exceed those of a particular role, yet Read and Write access are calculated differently. For more information about permissions for users in multiple roles, see Permissions for users assigned to multiple roles.
If role permissions use a static list, use a static list when you define user permissions for the same members. Otherwise, your role settings might not be valid. For more information, see Best practices for business roles.
Because user permissions cannot exceed those of the role, editing the permissions for the role can restrict customized user permissions.
You cannot give Read or Write access to a member set from a Time dimension. Time parameters are specified in assignment properties.
Before users who have been given Write access can write to an assignment (and make changes to the application database), data submission must be enabled in the corresponding assignment. For more information, see "Assign Forms to a User for Data Submission" in the product help.
Even though a member set can be used in more than one model, the changes that you make will apply to the selected business role only.
To edit permissions to a member set for a business role
In the Workspace Browser pane, click Security and Roles.
At the top of the Security and Roles workspace, in the View menu, select Business Roles Only.
In the list of roles, click the role whose permissions you want to change.
Click the Role tab. The top half of the Role page lists all the member sets in the model site. The Read access and Write access columns display a summary of the permissions for the role.
All. The business role has Read or Write access to all members in the member set.
None. The business role has no Read or Write access to any member in the member set.
Custom. The business role has access permissions configured for individual members in the member set. To see the custom permissions, select the member set. A list of members and their corresponding permissions (None, Read-Only, Write-Only, Read + Write) appear in the bottom half of the page.
(Optional) In the Filter member sets by model drop-down list, select the model that the role will have access to. Only member sets that belong to the selected model will be displayed.
Select the member set whose permissions you want to change.
In the Workspace Actions pane, under Edit Role Permissions, click the appropriate Edit button to modify the Read or Write access to the member set. The Change READ Permissions for Business Role or the Change WRITE Permissions for Business Role dialog box opens. These two dialog boxes function similarly.
In the Change READ or WRITE Permissions for Business Role dialog box, the Selected Members column lists the members that the business role can access. You can search by member properties to find particular members. For information about finding members or about how to use the Change READ or WRITE Permissions for User dialog box, see "Change READ or WRITE permissions for user" in the product help.
In the Available Members box, specify the permissions, as follows:
To grant access, select the check box next to a member. Selecting a check box gives Read or Write access to the member for the role and adds the member to the Selected Members list.
To deny access, clear the check box next to a member. Clearing a check box denies Read or Write access to the member for the role and removes the member from the Selected Members list.
Right-click a member to add or remove descendants by using the shortcut menu. This feature lets you work with a dynamic set instead of explicit member selections. You may want to clear check boxes for members that belong to a set before the menu command becomes available.
Read access for members that have descendants is determined by the Read access that is defined for its descendants. In PerformancePoint Add-in for Excel, the value of the member will be the result of its visible descendants (the descendants to which the user has Read access). Therefore, only leaf members will display a check box in the Change READ Permissions for Business Role dialog box.
After you have selected or deselected appropriate members, click OK.
To return the permissions settings for the selected member set to the default permissions for the role, click Restore Defaults. Any custom user permissions that apply to the member set will also be reset to the default permissions.
Repeat this process to enable Read access to at least one member in every member set that the model contains. For more information about this requirement, see Best practices for business roles.
On the File menu, click Save Model Site to save your changes.
See Also
Tasks
Enable custom user permissions for a member set