Restrict end users to view/run reports only, with no write, edit, delete, copy, move or rename acces

Question

Requirement is to restrict business end users to view/run reports only, with no write, edit, delete, copy, move or rename access in BI Catalog (Shared Folders > Custom > ANL > Business Reports > Report).

Approach 1 - Custom Role (Did Not Work):

Created custom role CUSTOM_BI_REPORT_VIEWER inheriting BI Consumer Role. Failed for users with broader roles (e.g. General Accounting Manager, Application Implementation Consultant) as Fusion role permissions are additive and override the restriction.

Approach 2 - Folder Level Restriction (Implemented):

BI Consumer Role set to Custom (Read, Traverse, Run/Schedule Publisher Report, View Publisher Output). Schedule and View Output included as some reports have large data volumes causing query timeouts when run directly. BI Author and BI Administrator changed from Full Control to Open to prevent end users inheriting these roles from overriding the restriction. Specific technical users granted Full Control. Cascade applied to all sub-folders and items. Tested with multiple end users - working as expected.

Questions:

Is folder-level restriction the recommended best practice?

Impact of changing BI Author/Administrator Role to Open at folder level?

Will this restriction persist through quarterly cloud updates?

Note: This is an Oracle Fusion Cloud Applications SaaS environment running version 26B (11.13.26.04.0). The exact cloud version was not available in the product version dropdown, hence 11.1.2.3.0 was selected as available option.

Bhaskar Konar · Answer

Hi @Vamsi Sugreevu,

Additionally, please take a look into the following post which might be useful.

Fusion BI Catalog Folder Management Best Practices — Cloud Customer Connect

Hope this help.

Thank you.

Bhaskar Konar · Answer

Hi @Vamsi Sugreevu,

Your observations are consistent with how BI Catalog permissions work in Oracle Fusion Cloud.

* Approach 1: Creating a custom application role that inherits from 'BI Consumer' is generally not sufficient to restrict users who already inherit broader BI privileges through other Fusion application roles. BI Catalog permissions are additive so the effective permissions are the cumulative (union) of all granted privileges rather than the intersection. In other words, assigning a more restrictive custom role does not reduce or override privileges that a user already inherits through another application role.
* Approach 2: Applying permissions directly at the BI Catalog folder level is the standard and supported mechanism for controlling access to catalog objects. Configuring the folder with only the required permissions (for example, Read, Traverse, Run/Schedule Publisher Report, and View Publisher Output) and propagating those permissions to subfolders and objects is a common approach for implementing a read/run-only reporting area.

Regarding your Questions:

* Is folder-level restriction the recommended best practice?

Folder-level security is the standard mechanism provided by BI Catalog to control access to catalog objects. It is generally the preferred approach when you need to restrict actions such as Edit, Delete, Copy, Move and Rename for specific report folders.
* What is the impact of changing BI Author/BI Administrator permissions to Open at the folder level?

Setting these permissions to Open on the specific folder means those roles can traverse and access the folder but do not automatically receive authoring or administrative privileges within that folder. This change applies only to that folder (and any descendants where the permissions are inherited) and does not modify the global capabilities associated with those application roles elsewhere in the BI Catalog.
* Will this restriction persist through quarterly updates?

BI Catalog folder permissions are stored as catalog metadata and are generally expected to persist across quarterly SaaS updates. However, as a general best practice, it is advisable to validate custom security configurations after each quarterly update, particularly if Oracle delivers changes to seeded catalog content or security behavior.

Hope this help.

Thank you.