Manage Permissions on Dashboards

Overview

We believe in transparency by default, and what a better way of communicating your information than using reporting dashboards (see Learn about Public or External Sharing to spread your data). However, there are countless reasons to restrict access to some information to just a certain part of your organization. With this in mind, Dashboard Hub provides an Advanced Restrictions mechanism. The way of implementing restrictions is going to sound familiar, since we mimicked Confluence’s page restrictions schema:

"Anyone can view and edit"
"Anyone can view, some can edit"
"Only specific people can view or edit"

You can access and change the dashboard restrictions from two places:

Click the lock icon at the top of any dashboard

Open the Dashboard settings window from the … More Actions menu

Remember to select Apply

Whenever changing anything in the Restrictions window, remember to select Save, or else the changes won't be saved.

Anyone can view and edit

This setting means that anyone in your Jira or Confluence instance is able to access the dashboard content:

Anyone can view the content
Anyone can edit the content.

The accesible content does not include the datasources. Datasources have their own access restrictions, you can read more in Learn about Datasources.

For those cases when you want everyone viewing your dashboard, but only specific users and/or groups editing it, then you have to select the next permission level Anyone can view, some can edit.

Anyone can view, some can edit

By choosing Anyone can view, some can edit, anyone can still view the page, but you remove the ability to edit this page from everyone but yourself. This is a quick way to lock down who can edit a page.

From there, you can choose to add specific people who you want to edit a page.

To assign specific people the ability to edit:

Type a user's name or a group into the search bar. (You can add multiple people and groups to the search bar.)
Because anyone can already view the page in this scenario, you can only assign specific people Can edit.
Select Add to add them to the list.
Select Apply to save the changes.

To remove someone or a group, simply select the Remove link next to their name.

If you only want specific people to view your page, change the page's setting to Only specific people can view or edit and manually add the people you want to be able to view it.

Only specific people can view or edit

This is the setting you want if you want to keep the page private or restricted to a subset of people who have access to the space. As soon as you select Only specific people can view or edit, the page will be locked down so that only you can view and edit it.

From there, you can choose to add specific people who you want to view or edit the page.

To assign specific people the ability to view or edit:

Type a user's name or a group into the search bar. (You can add multiple people and groups to the search bar.)
Select Can edit or Can view.
Select Add to add them to the list with the selected view or edit permission.
Select Apply to save the changes.

To remove someone or a group, simply click the Remove link next to their name.

Some other things to keep in mind

Instead of applying restrictions to individuals, you can use Confluence groups to save on typing out individual names. Learn how to create and update groups.
Confluence permissions are additive. This means that if someone is in two Confluence groups, and one group has permission to view a page while the other does not, that person will still be able to see the page because at least one of the groups they're in has permission to view it.
Confluence's permissions model is set up so that content can only be further restricted from whatever the container is set at. A page cannot have greater access than its container. This creates a ceiling of access. The ceiling for a given permission (view, edit, comment, etc.) could be the site, space, or a parent page, depending on where the restrictions are applied.
You can make certain spaces (or even your whole site) available to the public, which means that anyone on the internet would be able to access your content.
If a user doesn't have access to the page, they won't receive a notification when @ mentioned.

Admin key

As an admin, there may be times when you need to look at content that you haven’t been given permission to view. For example, you may need to unlock a restricted page or space created by an inactive user, or you may need to diagnose content access issues. Admin key allows site admins to access restricted content so they can address these needs.

Admin key is also only available on Confluence's premium plan.

What does the lock icon mean?

You can find the padlock icon that represents a page's restrictions at the top of the page. Primarily, it opens the Restrictions window, but how it displays can also give you a quick clue to who can view the page.

The lock icon does not offer any information about who can edit the page, only who can view the page.

	Anyone in the space can view this page.
	This page is set so anyone can view it, but it is inheriting view restrictions from one of its parent pages. Only people who have view access on the restricting parent page can view this page.
	Only specific people can view this page.

How restricted are restrictions?

If your page has view restrictions, it won't display for anyone who doesn't have permission to view it, neither in the page tree, nor any macros. Unless someone else has specifically been given a link to your page, they won't know it exists.

Exceptions:

If someone has shared a link to a restricted page, or provided a link to it on another page that can be viewed, the link will have the title of the page as part of the URL. However, they won't be able to tell anything else about the page, including who created it, who has permissions, or when it was updated.
Space admins can view and change the restrictions on any content within their space.
Site admins can view and change the restrictions on any content within their site.