These are the docs for the Metabase master branch. Some features documented here may not yet be available in the latest release. Check out the docs for the latest version, Metabase v0.49.

Data permissions

This page covers permissions for databases and tables. If you haven’t already, check out our Permissions overview.

Setting permissions on a database, schema, or table

To set data permissions on a database, schema, or table for a group:

  1. Hit Cmd/Ctrl + K. Search for Permissions and click on the Permissions settings result. Metabase will default to the Data tab.

Or

  1. Click on the gear icon in the upper right.

  2. Select Admin settings.

  3. Click on the Permissions tab, which defaults to the Data tab.

You can view permissions either by group or by database.

Data permission types

You can set the following types of permissions on a database, schema, or table:

View data permissions

The View data permission determines what data people can see. Permission levels include:

For which questions, models, and dashboards a group can view, instead see collection permissions.

Can view data permission

Setting to Can view means the group can view all the data for the data source, provided they have collection permissions to view questions, models, and dashboards.

In order to view the data in the Browse databases section, the group would additionally need to be able to Create queries.

Granular view data permission

Granular view data permission is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).

This option lets you set View data permissions for individual schemas or tables. Available only for databases and schemas. If you select Granular for a database or schema, Metabase will open that data source and ask you to set permissions for each individual schema or table.

For tables, you have the option to set either Can view or Sandboxed.

Sandboxed view data permission

Sandboxed view data permission is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).

Allows you to set row-level permissions based on user attributes.

See Data sandboxes.

Impersonated view data permission

Impersonated view data permission is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).

The Impersonated option lets you use a role in your database to specify what data people can view and query. Impersonation can only be set at the database level, as Metabase will defer to the permissions granted to the database role.

See impersonated view data permissions

Blocked view data permission

Blocked view data permission is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).

Blocked ensures people in a group can’t see the data from this database, regardless of their permissions at the collection level.

The Blocked view data permission can only be set at the database level.

Essentially, what Block does is make collections permissions insufficient to view a question. For example, even if a question is in a collection that the group has access to, but that question queries a data source that is blocked for that group, people in that group won’t be able to view that question unless they’re in another group with the relevant data permissions.

If a person in a blocked group belongs to another group that does have View data access to the data source, that more privileged access will take precedence (overruling the block), and they’ll be able to view that question.

Create queries permissions

Specifies whether people can create new questions based on the data source. Creating queries includes the ability to drill-through and filter questions, or anything that involves changing the results.

To enable Create queries permissions for a group, that group must be able to view the data source (“Can view” permission.)

Create query levels include:

Query builder and native create queries permission

People can use Metabase’s query builder or its native/SQL editor.

Query builder only create queries permission

People can create new questions and drill-through existing questions using Metabase’s query builder.

Granular

The granular option lets you define Create queries permissions for each schema and/or table in the database.

Download results permissions

Download permissions is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).

You can set permissions on whether people in a group can download results (and how many rows) from a data source. Options are:

  • No (they can’t download results)
  • Granular (you want to set access for individual tables or schemas)
  • 10 thousand rows
  • 1 million rows

Manage table metadata permissions

Data model permissions is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).

You can define whether a group can edit table metadata. Options are:

  • Yes (meaning, they can edit metadata for that data source).
  • No
  • Granular (to set permissions specific to each table).

Manage database permissions

Database management permissions is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).

The Manage database permission grants access to the settings page for a given database (i.e., the page at Admin settings > Databases > your database).

On the database settings page, you can:

Note that only admins can delete database connections in your Metabase, so people with Manage database permissions won’t see the Remove database button.

Revoke access even though “All Users” has greater access

If you see this modal pop-up, Metabase is telling you that the people in the All Users group (that is, everyone in your Metabase), have a higher level of access to the database, schema, or table that you’re setting permissions on. To limit your current group to your preferred permission level, the All Users group must have a less permissive level of access to the data source in question.

Further reading

Read docs for other versions of Metabase.

Thanks for your feedback!

Want to improve these docs? Propose a change.