Dashboard Permissions

Gainsight NXT

​Introduction

This article explains how admins can enable and assign permissions to dashboards. Admins can restrict a user/group of users from accessing a single or set of dashboards. 

This document explains the following topics:

• Dashboard Permissions (Single dashboard)
• Permissions at Folder Level (Set of Dashboards)
• Permission Assignments
• Revoke Permissions and Users/User Group Deletion
• Create a UserGroup

Prerequisite

• Ensure that your Admin is identified as a Super Admin in the Administration > Operations > User Management page in order to have unrestricted access to the Dashboards and Dashboard folders. For more information, refer to Gainsight User Object.

Once a user is added to the Users List, it may take at least 6 hours to reflect your user as a Super Admin, if you want the update to be reflected immediately, navigate to Administration > Security Controls > Sharing Setting, in the User Attributes section, click Refresh User Data. For more information on User Attributes, refer to User Attributes article.

Key Terms

Term / Dashboard Permissions	Description
Private, Public, or Shared access	Making a Dashboard Private means that no one but the creator has the access to it Making a Dashboard Public - View allows anyone with access to Gainsight Home to view it.     Note: Admins can also view the same from Dashboard        Builder Making a Dashboard Public - View & Edit allows anyone with access to Gainsight Home to view it and anyone with access to Dashboard Builder to edit it Give access to specific people allows you to grant permission to a specific user or group of users
User and UserGroup	Users (GS Users): Can be NXT users, External users (partners, customers) UserGroup: A group of users created from Administration > Security Controls > Sharing Setting > Sharing Groups tab
New Dashboards	By default are created in Private mode Can be accessed by others only after the user shares the same manually.
Super Admin	Gainsight ensures that Dashboards created by a user are not locked out when the user creates private folders and then leaves the company. The Super Admin concept ensures to prevent this situation. Super Admins are similar to System Admins in that they have access to everything.       A Super Admin can: Use the View as option to search for a User based on their Name or Email (including inactive users) View the Dashboard as the owner and make required edits to sharing settings (Super Admin can make all the same edits as the logged in user)
Normal Admin	Cannot manipulate Admin-level permission Cannot View as someone else’s dashboard
Inheriting permissions from its parent	Having access to a Folder gives users the same level of access to all of the Dashboards and Folders within it Having access to a Dashboard gives users the same level of access to all of the reports within it

Dashboard Permissions (Single Dashboard)

Admins can grant permissions to a user/group of users on a single dashboard at Administration > Analytics > Dashboard Builder. The following image shows the levels of permissions available in the Set Permissions window.

To apply permissions on dashboards:

1. Navigate to Administration > Analytics > Dashboard Builder > [select a folder/specific dashboard] > [click on the permissions icon]. The Set Permissions window is displayed.

Note: Assign Permission icon is enabled only when you are the admin for a particular dashboard. If you are not the admin of the dashboard, the Assign Permission icon will be restricted.

In the Set Permissions window, the access level will be Private by default and no one but the creator has access to it. As an admin, you can change the access level to Public - View and Public - View & Edit but as a Super Admin, you can even change the access level to Public - View, Public - View & Edit, and even Admin as required.

2. Select Give access to specific people.
   Note: You can select Public- View give permissions to the users to only view the specific dashboards or you can even select Public - View & Edit to allow anyone with access to Gainsight Home to view it and anyone with the access to Dashboard Builder to edit it.
3. Select Users or UserGroup from the search drop-down list.
4. Start typing the desired user’s name, so that the matching users will be listed below from where you can select.
5. As an admin/super admin, decide what level of access you want to grant to the specific user(s) or User Group(s).
6. Click ADD.

Note: Before you select a UserGroup, you need to create the same. To know about how to create a UserGroup, refer to the Create a User Group section in this article.

7. When you click ADD, the list of users/user groups that have permissions on the asset would be displayed at the bottom of the same window. Click the delete icon to revoke access anytime.

Note: If the listed user is an admin, you will not be allowed to revoke their access when you have only View and View & Edit permission to a specific dashboard. Only Super Admin can assign permission to such users.

Permissions at Folder Level (Set of Dashboards)

Admins can apply permissions on dashboards using folders. This section explains how you can apply permissions to a user/group of users on a set of dashboards grouped under a folder from  Administration > Analytics > Dashboard Builder.

Limitation: You cannot create sub-folders (nested folders) at third level. Only two levels of subfolders are allowed under Home. Refer the following image.

Notes:

• In the above image, Home > Folder_1 (2nd level folder) > Folder_2 (3rd level folder) displays all three levels of folders and dashboards can be saved in any of the above folders. By default they will be saved to Uncategorized, a system folder available for all users. 
• Permissions will be honored up to three levels of asset hierarchy (asset is either a folder or a dashboard). The Home folder is accessible to everybody.

Permission Assignments

Following are the permission levels:

• Private: Dashboards/Folders can be accessed only by the owner and admin
• Public - View: Everyone can read dashboards with this level of permission
• Public - View & Edit: Everyone can read/edit dashboards with this level of permission
• Give access to specific people: Only specific user(s) or group of user(s) who are given access can access the dashboards

When a permissions icon is clicked on an asset (dashboard), the option that is highlighted (selected) shows the permission level granted on that asset.

In the permissions assignment screen on an asset, the permissions inherited from all of its parents will be shown. In the dashboard listing screen, action icons will be greyed out if the user doesn't have that permission.

When a user with only a Public - View permission clicks on a dashboard, the dashboard icons he doesn't have access to will be greyed out.

Revoke Permissions and User/User Group Deletion

Role	Revoke capabilities
Super Admin	Can see all the dashboards that are shared with users/group of users. Can edit and remove users access if required.
Admin	Can control who gets to see items in the dashboard but not edit or delete items inside the dashboard. Admin can revoke access from the users with whom the admin shared the dashboard.
User	Can see all the Dashboards shared with the user through the various sharing options. User can access the dashboard only when the permissions are granted. User cannot revoke access as the user might have only limited access to others’ dashboards that cannot be edited. Note: User with only a Public - View level of permission, clicking on a dashboard will take the user to the dashboard but grey out all the icons the user doesn't have access to.

To revoke access:

1. Navigate to Administration > Analytics > Dashboard Builder > [click the permission icon] for any dashboard. Set Permissions window is displayed.
2. In the Who has access section, click the delete icon to remove the user(s) or group of user(s) from the dashboard. 

Notes: 

• You can revoke the access from any user who is admin/creator of the dashboard only if you are a Super Admin. Otherwise, users who have been granted View or View & Edit permissions, will not be able to revoke access for other users in the same dashboard.
• In the Set Permissions window of a dashboard, if the user with whom the dashboard is shared inherits the permissions from the parents, the user’s permissions level will be shown.
• If you are the admin or you have been assigned admin level of access to a specific dashboard, other users with View/View & Edit permissions will not be able to delete the user from the list or change the access level.

Limitations

• Access Levels: For the logged in user, the list of dashboards (assets) that the user can access will be displayed on dashboard listing screen, on home page, or any other consumption area should be controlled only for the assets the user has access to. All the assets (folders or dashboards) should be displayed along with all the parents in the folder hierarchy.
  Note: If you change the access level from a specific user to Public - View/Public - View & Edit, it will revoke the access granted to all the specific users/user groups. Only Super Admin can do this action for any dashboard user.
• View as: Super Admin can only view permission assignment which are Private when Admin and current users are different. View as icon is displayed only when you logged in as Super Admin and Super Admin are similar to System Admin in that they have access to everything. Admin/Users will not have the three dot/View as icon available on the Dashboard Builder page. This will quickly help you to identify if you are the Super Admin. 
  Note: For more information about how a user can be identified as Super Admin, refer to the Prerequisite section in this article.

 

• You can move only those dashboards for which you have the access, or you are the admin. If you do not have the permission, the checkbox, MOVE TO field, Delete icon, and the permission icon will be disabled. You can only mark them as favorites.
  Note: Only 50 dashboards at a time may be moved from one folder to another.

Create a User Group (Sharing Groups)

Before you select a UserGroup, you need to create the same.

To create a UserGroup:

1. Navigate to Administration > Users and Permissions > Data Permissions > Sharing Groups
2. Click +New Sharing-Group.
3. Enter a name for the user group. While naming the New User Group, avoid using space, numbers, or special characters as only Alphanumeric strings are allowed.
4. Click Ok.
5. Provide the criteria details in the Users meeting the following criteria section.
   Or, Add users manually to create a group. For more information about how to add users manually to create a group, refer to the Sharing Groups section in the Gainsight Sharing Settings article.
6. Click Update.

 

7. Navigate back to Administration > Analytics > Dashboard Builder > [click on the permission icon].
8. Select Give access to specific people.
9. Select UserGroup option from the search drop-down list.
10. Start typing the UserGroup name that you just created at Administration > Security Controls > Sharing Setting > Sharing Groups.

 

Note: In the Set Permissions window, you can access the list of user groups that are created at Administration > Security Controls > Sharing Setting > Sharing Groups, and assign permissions if you are a super admin.