The post describes how to setup a group of restricted users in business objects.

As the result the users will not be able to create new reports.

The users will be able to run reports, drill, but not edit or save.

(demo data)

Let’s start

In CMC create a group (Restricted Users) and add the restricted users:

Root Level Security

For Folders, setup root level security:

Click “Add Principals”:

Add the group and click “Add and Assign Security”:

Add “View On Demand” and click “OK” and then “Close”

In the same way, assign View-on-Demand right for the top level of:

• Universes
• Connections
• QaaWS

Configure Web Intelligence

In CMC Home, select “Applications”

Open User Security for Web Intelligence:

Click “Add Principals”
Add the group and click “Add and Assign Security”
Add “View On Demand” and click “Apply” (not “OK”)

Switch to Advanced tab, and click “Add/Remove Rights”:

Select “Application/Web Intelligence”:

Grant the following rights:

• Enable drill mode
• Extend scope of analysis
• Merge dimensions for synchronization

Click “OK”, “OK”, “Close”

Disable Performance Management

It might make sense to disable Performance Management for Everyone.

Select “Performance Management” in “Applications”, modify “User Security”, select “Everyone”, remove View right, remove “Inherit From Parent Folder”, remove “Inherit From Parent Group”. Click “OK”, “Close”

As an alternative, you could deny access to Performance Management for the group of the Restricted Users.