With the level-based security structure, user profiles, permissions, various access controls, and settings work together to protect data. Manage these settings and controls in sheets, accounts, levels, and versions.
How You Get There
Go to various areas of your instance, explained in each step.
Before You Begin
- Admin Access > Users
- Admin Access > Roles
- Model Management Access > Model
- Model Management Access > Organization Structure
- Model Management Access > Versions
Level-Based Security Structure
Set Up Basic View Access
To allow users to view data:
- Create user profile and password. Go to Administration > Users.
- Give the user permission to view data. Go to Administration > Roles. Assign the user a role with at least Access Sheets, Access Reports, or Access Discovery permissions.
- Give the user access to the versions. Go to Modeling > Versions. Choose Locked, Locked Except Notes, or Visible for the Users drop-down.
- Give the user ownership to levels. Go to Modeling > Levels and select a level. From the Level Owners selection box, use Ctrl+click to assign ownership to the user.
- Make the level visible in the accessible versions. Go to Modeling > Levels and select the owned level. Choose the accessible version from the Version selector drop-down and select the checkbox.
- For users to view data on sheets, add the level to a level-assigned sheet. Go to Modeling > Levels and select the owned level. From the Sheets section, select the checkboxes next to the sheets to add the level. This adds all child levels of the level to the sheet automatically.
Set Up Basic Edit Access to Plan Versions
To allow users to edit data, add the following:
- Give the user permission to edit data. Go to Administration > Roles. Edit the role: select Editable Sheet Access.
- Give the user edit access to the versions. Go to Modeling > Versions. From the Access Controls section for Editable Sheet Access, choose Full Access.
Or, assign them a user-assigned sheet without the Salary Detail sheet setting. See Building Sheets.
Restrict Basic Edit Access to Actuals
If you want only certain users to edit actuals, create a specific role for it and refine the version access. This blocks others without the role from being able to edit actuals versions.
To create a privileged role for actuals access:
- Create a new role. Go to Administration > Roles > New Role. For Role Name, enter a name such as Actuals Access, or Privileged Access. Select Editable Sheet Access and Privileged Actuals Access. Then assign the new role to the users who can edit actuals.
- Give only privileged users access to the actuals versions. Go to Modeling > Versions. In the Access Control section of the settings for the actuals versions:
- From the Privileged Actuals Access drop-down, select Full Access.
- For all other user type drop-downs, select any other options besides Full Access.
- Repeat for all actuals, or at least the leaf-level actuals. Only leaf-level actuals are editable. Leaf level actuals are actuals without sub-versions that roll up to it.
- Make the actuals versions available. Go to Modeling > Levels. For levels owned by the users, choose any leaf-level actuals version from the Version Selector drop-down. Select the checkbox.
Now only users with this new role can edit the actuals versions available in the levels they can access.
To make an existing administration role the only role that can edit actuals:
- Go to Administration > Roles and select Edit next to the administrator role. Select Model > Version and Editable Sheet Access and save.
- Go to Modeling > Versions. For only the Admin user type of each leaf level actuals version, select Full Access.
Now only users with the administration role can edit the actuals versions.
Refine View and Edit Access
- Use Salary Detail settings: Make an account's details or a modeled sheet viewable and editable to only users who have the Access Salary Detail permission.
- Hide or lock accounts on standard sheets: To hide, go to Modeling > Level Assigned Sheets. Select a standard sheet and select Customization for Sub-Levels. From the selection box on the left, select an account. Uncheck levels and sub-levels in the selection box on the right. You hide the account data for unchecked levels in that sheet for users who have access to only those levels. To lock, select the sheet and select Account Groups. Select an account from the left box. Select the Read Only checkbox on the right. See Building Sheets.
- Use cube restrictions: Hide intersections of data in a cube sheet for all users. See Build Cube Sheets.