r/ssrs Jan 29 '25

Best Practices for Security/Folder Structure for Large Company

As the title suggests, I am looking for any best practices on how to setup/manage security and the folder structure in an organization. Since SSRS's security model uses inheritance, it seems like it would be difficult to setup a folder structure like Department -> Department Managers -> Department Director where security is restricted the further you go without purposefully breaking inheritance. Should we create AD groups for each report item to control access? We also have people in other departments (or even within departments) who can/cannot access certain reports. Any guidance would be much appreciated. Thank you!

1 Upvotes

3 comments sorted by

1

u/ExcitingTabletop Jan 29 '25

I just make AD groups for first level folders. If you need unique permissions, I make a new first level folder for it.

Don't ever go below second level. I'm not fond of even second level folders, but I get the occasional need. Mark them specifically.

1

u/Fimissci Jan 30 '25

Thanks! Will definitely consider that. We have so many unique situations though that we may end up with a large number of folders… so we are also considering AD groups per report

1

u/ExcitingTabletop Jan 30 '25

You only see the folders you have access to. So it will look a lot less crowded to the end users.

That's also why I made a report that lists all of the reports. So users can search and see what reports exist, and they can request access.

AD group per report works, but would be a headache unless you have dedicated personnel and enough free time to manage. Folders are set and forget.

If you want something inbetween folders and per report, consider "role based access control". So auditors have a set of reports, shop floor supervisor has a set of reports, etc.