Need to give a user or group permission to manage reports, folders, data sources, and other SSRS content? In SQL Server Reporting Services (SSRS), item-level roles control access to report server content. The Content Manager role provides broad permissions to manage reports and other items in the report server folder hierarchy.
Quick answer: To grant a user or group Content Manager access, open the SSRS web portal, select the Home folder, open Manage folder → Security, add the Windows user or Active Directory group, and assign the Content Manager role. Content Manager controls item-level content; it does not replace the System Administrator role for server-level operations.
SSRS roles and permissions explained
SSRS uses role-based security. A role is a collection of tasks that determine what a user or group can do. Permissions are divided into item-level and system-level roles.
| Role | Scope | Typical use |
|---|---|---|
| Browser | Item | View and run reports, browse folders, and perform other viewing tasks. |
| Publisher | Item | Publish reports and linked reports. |
| Content Manager | Item | Manage reports, folders, resources, data sources, security, and other report server content. |
| Report Builder | Item | Work with report definitions and Report Builder. |
| System User | System | Access system-level features required by users and client tools. |
| System Administrator | System | Manage server-level properties, roles, security, jobs, and shared schedules. |
For most users who only need to view reports, Microsoft recommends using a limited role such as Browser. Content Manager should be reserved for users who actually need to manage report server content.
What permissions does the SSRS Content Manager role provide?
The predefined Content Manager role includes the item-level tasks needed to manage report server content. These include managing reports, folders, resources, report history, models, subscriptions, shared data sources, and security for individual items.
- Manage reports: Add, delete, and modify reports and report properties.
- Manage folders: Create, modify, and delete folders.
- Manage data sources: View and modify shared data source properties.
- Manage resources: Add, modify, and delete resources.
- Manage report history: Manage report history and related settings.
- Set security for individual items: Define security policies for reports, folders, resources, and data sources.
- View reports and folders: Access and navigate the report server content hierarchy.
Content Manager is an item-level role. It does not automatically grant server-wide system permissions such as managing report server properties, system role definitions, jobs, or shared schedules. Those capabilities are part of the System Administrator role.
How to grant Content Manager permissions in SSRS
You can assign SSRS roles from the report server web portal. The following steps grant Content Manager access at the Home folder level, allowing the assignment to be inherited by items below it unless inheritance is later overridden.
1. Open the SSRS web portal
Open your SSRS web portal in a browser. A typical URL is:
https://<report-server-name>/reports
The exact URL and port depend on your report server configuration. The options visible in the web portal depend on your permissions. citeturn0search2
2. Open the Home folder security settings
Open the Home folder, select Manage folder, and open the Security section.
3. Add the user or Active Directory group
Select Add group or user and enter the Windows account or Active Directory group that should receive access. For organizations managing access centrally, assigning permissions to an Active Directory security group can make ongoing access management easier than assigning individual users.
4. Assign the Content Manager role
Select Content Manager and save the role assignment.
How SSRS permission inheritance works
Role assignments are normally inherited through the report server folder hierarchy. A role assignment on the Home folder can therefore provide access to reports, folders, shared data sources, and other items below it.
You can override inherited security for a specific folder or item by creating a separate role assignment. This is useful when a department or report requires more restrictive access.
SSRS item-level vs system-level permissions
One common source of confusion is assuming that Content Manager gives complete control over the SSRS server. SSRS separates content permissions from server-level permissions.
| Requirement | Permission scope | Typical role |
|---|---|---|
| View and run reports | Item | Browser |
| Publish reports | Item | Publisher |
| Manage reports, folders, data sources, and item security | Item | Content Manager |
| Manage report server properties | System | System Administrator |
| Manage system roles and shared schedules | System | System Administrator |
System-level permissions do not automatically provide access to items in the report server folder hierarchy. Depending on the task, a user may need both system-level and item-level role assignments.
Common SSRS permissions problems
- User can open SSRS but cannot see reports: Check the item-level role assignment on Home or the relevant folder.
- User can view reports but cannot edit them: Browser is intended for viewing; a publishing or content-management role may be required.
- Content Manager still cannot perform a server-level operation: Check whether the operation requires a system-level role such as System Administrator.
- User has access to a parent folder but not a specific report: Check whether inheritance was broken and a separate security policy was applied to the item.
- Too many individual permissions are difficult to maintain: Consider assigning roles to Active Directory groups instead of individual users.
Frequently asked questions
What role allows a user to manage SSRS reports?
The predefined Content Manager role provides broad item-level permissions for managing reports and other report server content.
Does Content Manager provide full SSRS server administrator access?
No. Content Manager manages report server items at the item level. Server-wide operations such as managing roles, server properties, jobs, and shared schedules are handled through system-level permissions, primarily the System Administrator role.
Where should I assign Content Manager permissions?
For broad access to report server content, Microsoft documents assigning the item-level role on the Home folder. You can create more specific role assignments on individual folders and items when access needs to be restricted. citeturn0search3turn0search4
Pro Tips:
1. Use the least-privilege role that satisfies the requirement. For centralized access management, consider assigning SSRS roles to Active Directory groups. Avoid creating unnecessary individual role assignments because they can become difficult to audit and maintain.
2. If you are migrating SSRS reports between servers, see the SSRS Reports Migration Wizard documentation.
See more
Kunal Rathi
With over 15 years of experience in data engineering and analytics, I've assisted countless clients in gaining valuable insights from their data. As a dedicated supporter of Data, Cloud and DevOps, I'm excited to connect with individuals who share my passion for this field. If my work resonates with you, we can talk and collaborate.
