---
title: Reporting security
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

You can configure access to reporting features in the **Permissions** application. Choose the permission matrix for **Module** -> **Reporting** and assign the available [permissions](https://docs.kentico.com/13/managing-users/configuring-permissions.md) to the appropriate user roles.

![Permission matrix of the Reporting module](https://docs.kentico.com/docsassets/13/reporting-security/Reporting_Permissions.png "Permission matrix of the Reporting module")

| Permission            | Description                                                                                                                                                                                                                                                   |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Read                  | Allows users to view existing reports.                                                                                                                                                                                                                        |
| Save reports          | Allows users to save reports into the report archive.                                                                                                                                                                                                         |
| Modify                | Allows users to create, modify and delete reports. This also grants permission to subscribe to reports.                                                                                                                                                       |
| Destroy               | Allows users to delete the version history of reporting objects.                                                                                                                                                                                              |
| Edit SQL queries      | Allows editing of the queries used to retrieve data for reporting components (graphs, tables and values). This permission is needed to create new reports, but it can be a security risk, since it allows users to run queries against the system's database. |
| Subscribe             | Allows users to subscribe to reports and their components. Subscription also needs to be allowed for individual reports through their properties.                                                                                                             |
| Set connection string | Allows users to change the connection string property of reports and their components. The report uses the specified connection string to access the database when loading data.                                                                              |

## Specifying connection strings for reports

You can restrict the database-level permissions of the SQL queries used for reporting by registering custom connection strings and assigning them to reports.

1. Prepare a user account for your database with the required security configuration.
2. Edit your administration application's _web.config_ file.
3. Add a new connection string into the __ section.
4. Enter authentication information (the _user id_ and _password_) for the appropriate database user account.

   ```html

   <add name="CMSReadOnlyConnectionString" connectionString="Persist Security Info=False;database=DBName;server=ServerName;user id=DBUser;password=password;Current Language=English;Connection Timeout=240;" />

   ```
5. Open the **Settings** application.
6. Select the **Security & Membership** category.
7. Choose the **Default report connection string** (in the **Reporting** section).

   > **Info:** **Connection string names**
   >
   > The setting loads the list of connection strings from the web.config and displays their _name_ attribute values. The _(default)_ option represents the _CMSConnectionString_ added by the application's initial database installation.

The system assigns the specified connection string to newly created reports. By default, all existing reports also inherit the connection string value from this setting.

### Assigning a connection string to a specific report

1. Open the **Reporting** application.
2. Edit any reports for which you wish to set a non-default connection string.
3. On the **General** tab, uncheck the **Inherit** box below the **Connection string** property and select a different option. You can also override the connection string value for individual reporting components (graphs, tables and values).

The system now uses the assigned connection string when executing the queries of reports. This limits the functionality of the queries according to the database permissions of the user account specified in the connection string. Only users who have the **Set connection string** permission for the _Reporting_ module are allowed to change the connection strings of individual reports.