Permissions in User Default and custom roles

User Default settings and custom roles control permissions for users and administrators. User Default defines a baseline for all users, while custom roles allow more specific permissions for selected users or groups. The table below lists all available settings, with additional details in the sections that follow.

This topic is applicable to Qlik Sense Enterprise SaaS, Qlik Sense Business, and Qlik Cloud Government. If you have a subscription for the Standard, Premium, or Enterprise edition of Qlik Cloud Analytics or Qlik Talend Data Integration, see Managing users - Capacity-based subscriptions.

Understanding User Default permissions

The User Default permissions act as a tenant-wide baseline profile, applying a standard set of permissions to all users in the tenant by default. Administrators can modify the User Default settings to remove certain permissions for everyone, effectively restricting broad access.

Understanding custom roles

To grant more specific or elevated permissions, custom roles are used. These roles allow administrators to selectively assign permissions to individual users or groups, overriding the restrictions set by the User Default role. This approach provides a granular and controlled way to manage access—first by limiting general permissions through the User Default role, and then by granting necessary access only to selected users or groups via custom roles.

Permission hierarchy

Default permissions and custom roles, along with built-in security roles, control user and administrator access at the tenant level. Additionally, space roles control user actions on content within specific spaces. For more information about the different types of roles, see Roles and permissions for users and administrators.

Permission settings

The following sections list the permissions available in the User Default or custom role settings.

For custom roles, you will also have the option to inherit the User Default permission, shown as "User default (permission setting)"—for example, "User default (Not allowed)". This means that the setting in the custom role will match whatever the default is set to.

The "Not allowed" option is only available for the User Default settings because custom roles can’t remove permissions that are already allowed by default.

Permission settings — Content types

The Content types section contains permissions to take action on different content types. These are user permissions.

Permission settings — Content types section
Subsection	Permission	Options
Applications	Share applications via fine-grained access control	Allowed: Space owners and users with the Can manage role can share individual applications with users or groups without adding them to the space. Not allowed: Users can only share the entire space, not individual apps.
Applications	In-app content download	No data: Users can only download images and PDFs. Data downloads are not permitted. Allowed: Users can download all types of app content. Not allowed: App content downloads are not permitted.
Automations	Automations	Allowed: Users have access to shared automations. Not allowed: Users can only access personal automations if they are assigned the Automation creator role. Admins can set User Default to not allowed and create custom roles to provide access to shared automations to a group of users.
Data content	Data connections	Allowed: Users can list, create, view, update, and delete data connections. Users can also read data from, and store data to, these connections. Read: Users can view data connections, select and load data from connections, and store data to data connections. Not allowed: Users cannot create, view, update, or delete data connections. Users also cannot read data from, or store data to, these connections. For more information, see Assigning permissions for users to work with data connections.
Data products	Manage data products	Consume only: Users have access to the Data marketplace. Allowed: Users can view, create, update, activate, and delete data products on the Data marketplace. Not allowed: Users cannot access data products on the Data marketplace.
Data quality	Manage validation rules	Apply only: Users can list and view validation rules (depending on their license), and apply rules on datasets. Allowed: Users can view, create, update, and delete validation rules on a space. Not allowed: Users cannot view validation rules.
Data quality	Manage semantic types	Assign only: Users can list and view semantic types (depending on their license), and apply semantic types on datasets. Allowed: Users can view, create, update, and delete semantic types. No space role is needed. Not allowed: Users cannot view semantic types.
Lineage	View lineage	Allowed: Users can view lineage and impact analysis between assets. Not allowed: Users cannot view lineage and impact analysis between assets.
Links	Manage links	Allowed: Users can view, create, update, and use links in the Analytics activity center. They can delete links that they created. Not allowed: Users cannot view or work with links in the Analytics activity center. For more information, see Who can create links.
Notes	Manage notes	Allowed: Users can create, view, update, delete, and share notes in activity centers and apps. Not allowed: Users cannot create, view, update, delete, or share notes in activity centers and apps.

Permission settings — Features and actions

The Features and actions section contains permissions for tenant-wide access to special features and actions. These are user permissions.

Permission settings — Features and actions section
Subsection	Permission	Options
None	Public link creation	Allowed: Users can configure anonymous access for apps. Not allowed: Users cannot configure anonymous access for apps. For more information about setting anonymous access permissions, see Setting permissions for users who can configure anonymous access. For more information about anonymous access, see Sharing app content with anonymous access.
Data quality	AI-based descriptions and suggestions	Allowed: Users can generate AI-based validation rules for datasets, and descriptions for any resources. Not allowed: Users cannot generate AI-based validation rules, descriptions or suggestions.
Data quality	Compute data quality	Read: Users can view the results of the data quality computation. Allowed: Users can compute data quality and view the results. Not allowed: Users cannot compute data quality.
Data quality	Configure Qlik Trust Score™	Allowed: Users can configure the Qlik Trust Score™ dimensions at the tenant level, view the score and its history. Not allowed: Users cannot configure, or view the Qlik Trust Score™.
Developer	Manage API keys	Allowed: Users can create, view, update, and delete their own API keys in their personal settings. Not allowed: Users cannot create or manage API keys.
Natural language query	Structured data	Allowed: Users can access Insight Advisor in all forms within Qlik Cloud. In other words, users can access Insight Advisor and Insight Advisor Chat from activity centers and apps. Not allowed: Users cannot access Insight Advisor with in Qlik Cloud. In other words, users cannot access Insight Advisor or Insight Advisor Chat from activity centers or apps.
Natural language query	Insight Advisor in Microsoft Teams	Allowed: Users can access Insight Advisor Chat from Microsoft Teams. Not allowed: Users cannot access Insight Advisor Chat from Microsoft Teams.
Space management	Request access to content	Allowed: Users can request access to content through the standard Qlik process. Not allowed: Users cannot request access. You can customize the message shown when they try to access content to guide them to your organization's process. For more information, see Customizing the access request process and Approving access requests.
Webhooks	Use webhooks	Allowed: Users can create, update, delete, and list their own webhooks using the webhooks API and automations UI. Not allowed: Users cannot manage webhooks. For more information, see Working with webhooks.
Learn	Access learning	Allowed: Can access the learning center. Not allowed: Cannot access the learning center. For more information, see Getting started and learning options.

Permission settings — Admin permissions

The Admin permissions section contains permissions for administrators of the Qlik Cloud tenant.

Permission settings — Admin permissions section
Subsection	Permission	Options
Content Security Policy (CSP)	Admin CSP	Allowed: Users can create, update, read, list, and delete content security policies. Not allowed: Users cannot manage content security policies. Managing Content Security Policy (CSP)
Curate content	Custom home	Allowed: Can customize the Insights Home page for all users. Not allowed: Can only customize their own home pages. For more information, see Customizing the Insights activity center Home.
Curate content	Public collections	Allowed: Can set any collection in the tenant to public or private. Not allowed: Cannot set any collection in the tenant to public or private. For more information, see Managing public collections.
Data products	Administer data products	Allowed: Users can access and manage all data products without space restrictions. Not allowed: Users cannot manage data products.
Data quality	Administer AI-based descriptions and suggestions	Allowed: Users can manage tenant settings for generating AI-based descriptions for any resources and any validation rule suggestions for datasets. They can access and manage AI generations without space restrictions. Not allowed: Users cannot manage AI generation settings.
Data quality	Administer semantic types	Allowed: Users can access and manage all semantic types. Not allowed: Users cannot manage semantic types.
Data quality	Administer validation rules	Allowed: Users can access and manage all validation rules without space restrictions. Not allowed: Users cannot manage validation rules.

'In-app content download' permission: Additional details

The value assigned to a user for the In-app content download permission can impact their access to other Qlik Cloud features. The following sections breaks down the difference between each of the available options.

No data

The following apply for the No data option:

Provides full access to Insight Advisor Chat when it is accessed through Qlik Cloud or an external collaboration platform (for example, Microsoft Teams).

Allowed

The following apply for the Allowed option:

Provides full access to Insight Advisor Chat when it is accessed through Qlik Cloud or an external collaboration platform (for example, Microsoft Teams).

Not allowed

The following apply for the Not allowed option:

The user will not see static charts in Insight Advisor Chat. The user will also not be able to see any visualizations when using Insight Advisor Chat through a collaboration platform (for example, Microsoft Teams). All other Insight Advisor Chat capabilities, such as natural language insights, will be available.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here