What are global report restrictions?

Totara's global report restrictions functionality provides a site-wide interface for defining global restrictions to the report data visible to a user or group of users.

It allows you to control what a user is able to see when viewing a report, limiting it to records for users in selected audiences, positions, hierarchies, or even individual users. Restrictions are applied to all reports by default, but can also be enabled or disabled on a report-by-report basis. For example, you can:

• Let an organisation view one or more reports but only see the records that belong to users of that organisation
• Limit access to records belonging to a subset of users (such as all suspended users) to a specific group (such as Site Administrators), without having to modify each individual report

This provides more fine-grained control over the specific user records that can be accessed than using content restrictions and avoids the need to configure content restrictions in every individual report.

Global report restrictions only apply to records that 'belong' to a specific user, for example a course completion record or an issued badge record. They are not applied to report sources where the individual records are not linked to a specific user, such as the 'Course' report, which just lists courses by name.

Defining which records can be viewed

Once the restriction has been created you can then specify which records can be viewed in reports the restriction is applied to.

You can toggle between:

• Allow all records to be viewed with this restriction: Allowing all records to be viewed using this button, which will hide the record-limiting options
• Restrict which records can be viewed: Limiting the records that can be viewed using this button, which reveals the record-limiting options

Assigning users to the restriction

The Users allowed to select restriction tab allows you to specify which users are assigned to the restriction.

Users assigned to a single restriction will have the restriction applied when viewing globally restricted reports and the report data will be limited to the records as defined in the View records related to tab of the restriction.

Users assigned to multiple restrictions will be notified of which restriction has been applied to a report being viewed and will have the option to change which restrictions are applied. They can select among any of the active restrictions they have been assigned to, but they must always select at least one restriction to be applied. 

You can toggle between:

• Make this restriction available to all users: Assigning to and allowing all users to apply this restriction using this button, which will hide the user-limiting options
• Restrict which users can use this restriction: Assigning to specific groups or individuals and limiting the users that can apply the restriction using this button, which reveals the user-limiting options

Viewing reports with active global report restrictions

Viewing user assigned to only one restriction

If the user viewing a globally restricted report is only assigned to a single restriction, the report is simply displayed with the report data being limited by the settings under the View records related to tab of the assigned restriction.

The Viewing records restricted by information box is hidden if the user has zero or one active restriction(s), or if global restrictions are not being applied to the report.

Viewing user assigned to multiple restrictions

If the user viewing a globally restricted report is assigned to multiple restrictions, the report is displayed along with a Viewing records restricted by box specifying which restriction has been applied to the data being displayed, and giving the user the option to change the applied restriction.

Combining both global and per-report content restrictions

When both global and per-report content restrictions are applied, they are combined using AND logic (e.g. a record is only shown if it matches both restrictions).

If you want to expose both global and content-restricted views separately to the same user you must create two separate reports.

Report caching and global report restrictions

Report caching support for global report restrictions is not currently available.

Next steps

• Enable global report restrictions
• Global report restriction settings
• Create global report restrictions
• Apply global report restrictions