If a person has the wrong level of access to the data that’s returned by a question or query, you’ll need to troubleshoot different levels of data permissions, starting from the most granular.
To give a group access to the native SQL editor, you must grant that group Unrestricted access to the database.
For more information about the different types of database permissions, check out the section on data access in our permissions documentation.
If a person is a member of multiple groups, Metabase will grant the most permissive level of access across all the groups in which they’re a member.
For example, if a person is a member of two groups — one which grants Unrestricted access to a database or table and another that grants No self-service access — that person will have full unrestricted access.
Remember that everyone is a member of the All Users group. We recommend you revoke permissions from the All Users group, and create new groups to selectively apply permissions to your data sources.
This feature is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).
If you’ve granted a group No self-service access to a database or table, people can still view saved questions and dashboards that draw on that database, as long as those questions and dashboards are stored in a collection that they have access to.
The Block data permission is available on paid versions of Metabase. If you block a group’s access to a database, members of that group will not be able to see any data from this database, regardless of their collection permissions.
If you get an error message that says something like “permission denied to <your table>”, you’ll need to check if the Metabase application has the correct permissions to query your database.
SELECT 1 FROM <your table>;
Your database has its own set of permissions that are configured for each person (or application) that logs in.
Database permissions apply at the level of your database connection, before your data and collection permissions are applied in Metabase.
This means that settings configured on the database side can prevent Metabase from connecting to certain schemas or tables, regardless of what you’ve set up on the Metabase side.
If you can’t solve your problem using the troubleshooting guides: