Default permissions and custom roles

Allowed: Space owners and users with the Can manage role can share individual applications with users or groups without adding them to the space.

Not allowed: Users can only share the entire space, not individual applications.

Allowed: Users can assign an engine size to applications, overriding the default automatic engine selection.

Not allowed: Users cannot override the automatic engine selection.

For more information, see Assigning engines to improve application performance.

No data: Users can only download images and PDFs. Data downloads are not permitted.

Allowed: Users can download all types of application content.

Not allowed: Application content downloads are not permitted.

Allowed: Users can use all GeoOperations functions.

No geocoding: Users can use all GeoOperations functions, except for Address to point lookup and Point to address lookup.

Not allowed: Users cannot use GeoOperations.

Allowed: Users have full access to write table functionality, including chart configuration, making changes in editable columns, and access to the change-stores API.

Read and write access only: Users can view and interact with write tables in applications. They can make changes in editable columns added to the write table. Users cannot create write table charts or edit existing write table chart configurations, and cannot use API keys to extract changes from the change-stores API.

Not allowed: Users cannot view or make changes in editable columns within write tables. They also cannot create write tables or edit existing write table configurations, and they are not granted access to the change-stores API.

For more information, see Setting permissions for write tables.

Allowed: Users can configure and generate all types of reports available with value-add capabilities of the Qlik Reporting Service.

On-demand reports: Users can only configure and generate reports using on-demand reporting and the Qlik Reporting Service API.

Not allowed: Users cannot work with any value-add capabilities of the Qlik Reporting Service.

For more information, see Setting permissions for metered reporting features.

Allowed: Users can create, manage, and view insight triggers.

Not allowed: Users cannot create or manage insight triggers. They can view insight triggers.

Allowed: Users can create and manage assistants.

Not allowed: Users cannot access assistants.

Allowed: Users have access to private automations.

Not allowed: Users do not have access to private automations. Admins can set the permission to Not allowed in the default permissions, and create custom roles to provide access to specific users or groups.

Allowed: Users have access to shared automations.

Not allowed: Users do not have access to shared automations. Admins can set the permission to Not allowed in the default permissions, and create custom roles to provide access to specific users or groups.

Allowed: Users can list, create, view, update, and delete data connections. Users can also read data from, and store data to, these connections.

Read: Users can view data connections, select and load data from connections, and store data to data connections.

Not allowed: Users cannot create, view, update, or delete data connections. Users also cannot read data from, or store data to, these connections.

For more information, see Assigning permissions for users to work with data connections.

Consume only: Users have access to the Data marketplace.

Allowed: Users can view, create, update, activate, and delete data products on the Data marketplace.

Not allowed: Users cannot access data products on the Data marketplace.

Allowed: Users can list, create, view, and delete glossaries. In glossaries, Users can read, create, edit, and remove terms. Users can verify terms.

Read and collaborate on terms only: Users can read, create, edit, and remove glossary terms.

Manage only: Users can list, create, view, and delete glossaries, but cannot change terms. In glossaries, Users can read, create, edit, and remove terms.

Not allowed: Users have no access to glossaries and their terms.

Allowed: Users can create, manage, index, and search knowledge bases.

Not allowed: Users cannot access knowledge bases in Qlik Cloud.

Allowed: Users can index knowledge bases and create a reindexing schedule.

Not allowed: Users cannot index knowledge bases.

Allowed: Users can search knowledge bases when asking questions of Qlik Answers assistants.

Not allowed: Users cannot search knowledge bases.

Allowed: Users can view lineage and impact analysis between assets.

Not allowed: Users cannot view lineage and impact analysis between assets.

Allowed: Users can view, create, update, and use links in the Analytics activity center. They can delete links that they created.

Not allowed: Users cannot view or work with links in the Analytics activity center.

For more information, see Who can create links.

Allowed: Users can view, manage, and delete, and run predictions with ML deployments. With sufficient permissions for the ML experiment, they can also deploy models to ML deployments. Additionally, users can view ML experiments.

Run predictions only: Users can run predictions from ML deployments using the real-time predictions endpoint in the Machine Learning API or the Qlik Predict analytics connector. Other access to ML deployments, such as batch predictions and ML model management, is blocked.

Not allowed: Users cannot view, manage, delete, or run predictions with ML deployments. They also cannot deploy models to ML deployments.

Manage ML deployments

Allowed: Users can view, create, manage, and delete ML experiments, including in-product access to GenAI for bias detection feature recommendations. They can also deploy models from experiments into ML deployments.

Manage ML experiments without GenAI: Users can view, create, manage, and delete ML experiments. They can also deploy models from experiments into ML deployments. They are blocked from using GenAI functionality in experiments—that is, using GenAI to recommend features for bias detection.

Not allowed: Users cannot view, create, manage, or delete ML experiments.

Manage ML experiments

Allowed: From any ML deployment they can access, users can activate and deactivate predictions for the source model.

Not allowed: From any ML deployment they can access, users cannot activate or deactivate predictions for the source model.

For more information about model approval by non-administrators, see Approving deployed models.

Allowed: Users can create, view, update, delete, and share notes in activity centers and applications.

Not allowed: Users cannot create, view, update, delete, or share notes in activity centers and applications.

For more information, see Enabling note creation.

Allowed: Users can use application analysis and Answers assistants within the Qlik Answers agentic chat from Answers.

Not allowed: Users cannot access application analysis or Answers assistants from the Qlik Answers agentic chat. If they have the permissions, they can use the experience with legacy assistants.

Allowed: Users can interact with data governance in the Qlik Answers agentic chat.

Not allowed: Users cannot interact with data governance in the Qlik Answers agentic chat.

Allowed: Users can view insights in feeds.

Not allowed: Users cannot view insights in feeds.

Allowed: Users can access the Help agent.

Not allowed: Users cannot access the Help agent.

Allowed: Users can access the review portal and Feedback in agentic assistants to view conversations from Qlik Answers agentic experiences.

Not allowed: Users cannot access the review portal or view Feedback in agentic assistants.

Allowed: Users can generate AI-based validation rules for datasets, and descriptions for any resources.

Not allowed: Users cannot generate AI-based validation rules, descriptions or suggestions.

Read: Users can view the results of the data quality computation.

Allowed: Users can compute data quality and view the results.

Not allowed: Users cannot compute data quality.

Apply only: Users can list and view validation rules (depending on their license), and apply rules on datasets.

Allowed: Users can view, create, update, and delete validation rules on a space.

Not allowed: Users cannot view validation rules.

Allowed: Users can assign classifications and regulations on datasets, and view assigned classifications and regulations.

Not allowed: Users cannot assign classifications and regulations, and cannot view assigned classifications and regulations.

Assign only: Users can list and view semantic types (depending on their license), and apply semantic types on datasets.

Allowed: Users can view, create, update, and delete semantic types. No space role is needed.

Not allowed: Users cannot view semantic types.

Allowed: Users can configure the Qlik Trust Score™ dimensions at the tenant level, view the score and its history.

Not allowed: Users cannot configure, or view the Qlik Trust Score™.

Allowed: Users can create, view, update, and delete their own API keys in their personal settings.

Not allowed: Users cannot create or manage API keys.

Allowed: Users can use Qlik MCP server.

Not allowed: Users cannot use Qlik MCP server.

Allowed: Users can access Insight Advisor in all forms within Qlik Cloud. In other words, users can access Insight Advisor and Insight Advisor Chat from activity centers and applications.

Not allowed: Users cannot access Insight Advisor with in Qlik Cloud. In other words, users cannot access Insight Advisor or Insight Advisor Chat from activity centers or applications.

Allowed: Users can access Insight Advisor Chat from Microsoft Teams.

Not allowed: Users cannot access Insight Advisor Chat from Microsoft Teams.

Allowed: Users can access the Qlik Analytics app.

Allowed with Intune: Users can access the Qlik Analytics mobile app with enforced MSAL authentication. MSAL cannot be disabled by users. Enables Intune MAM data protection policies.

Not allowed: Users cannot access the Qlik Analytics app.

For more information, see Setting access to the Qlik Analytics mobile app and Securing and configuring the Qlik Analytics mobile app with Microsoft Intune.

Allowed: Users can activate and deactivate preview features.

Not allowed: Users can view available preview features but cannot activate or deactivate them.

For more information, see Managing feature preview for your tenant.

Allowed: Users can request access to content through the standard Qlik process.

Not allowed: Users cannot request access. You can customize the message shown when they try to access content to guide them to your organization's process.

For more information, see Customizing the access request process and Approving access requests.

Allowed: Users can create, update, delete, and list their own webhooks using the webhooks API and automations UI.

Not allowed: Users cannot manage webhooks.

For more information, see Working with webhooks.

Allowed: Users can list, enable, disable, change the space, change the owner, manage automation settings, list and delete connections, list users, and delete automations.

Not allowed: Users can only manage their own automations.

Allowed: Users can upload and manage extensions.

Not allowed: Users cannot upload or manage extensions.

Allowed: Users can upload and manage themes.

Not allowed: Users cannot upload or manage themes.

Allowed: In the Administration activity center, users can activate and deactivate predictions for any deployed model in the tenant. From any ML deployment they can access, users can also activate and deactivate predictions for the source model.

Not allowed: In the Administration activity center, users cannot activate or deactivate predictions for any deployed model in the tenant. However, users can activate and deactivate predictions for the source model from any ML deployment they have access to.

For more information about model approval by administrators, see Working with model approval as an administrator.

Allowed: Users can list, open, and delete any experiment or deployment. Users can also activate and deactivate predictions for any deployed model via the Administration activity center.

Not allowed: Users cannot list or delete experiments or deployments, or activate and deactivate deployed models. They cannot access the Qlik Predict section of the Administration activity center.

Manage ML experiments and deployments

Allowed: Users can create, update, read, list, and delete content security policies.

Not allowed: Users cannot manage content security policies.

Managing Content Security Policy (CSP)

Allowed: Can customize the Insights Home page for all users.

Not allowed: Can only customize their own home pages.

For more information, see Customizing the Insights activity center Home.

Allowed: Can set any collection in the tenant to public or private.

Not allowed: Cannot set any collection in the tenant to public or private.

For more information, see Managing public collections.

Allowed: Users can access and manage all data products without space restrictions.

Not allowed: Users cannot manage data products.

Allowed: Users can manage tenant settings for generating AI-based descriptions for any resources and any validation rule suggestions for datasets. They can access and manage AI generations without space restrictions.

Not allowed: Users cannot manage AI generation settings.

Allowed: Users can access and manage all semantic types.

Not allowed: Users cannot manage semantic types.

Allowed: Users can access and manage all validation rules without space restrictions.

Not allowed: Users cannot manage validation rules.