Updates to Qlik Cloud Security Roles

[Sonja_Bauernfeind]

On April 16th, 2024, Qlik is launching a highly anticipated capability: custom security roles.

What do custom security roles do?

Custom security roles introduce fine control of data export and access permissions within Qlik apps. This allows you to tailor permissions to your specific needs, enhancing data security and compliance.

The first delivery on April 16th includes the capability to control who can export content. Additional capabilities will be added soon after, such as who can create data connections, reports, and similar.

What does this mean for me?

As part of this update, the existing "has restricted view" space role will gain the ability to export data to Excel. This adjustment is in line with Qlik's capacity-based pricing model, ensuring basic users have essential tools.

If you do not wish for users with the "has restricted view" space role to be able to export data, you will need to create a custom role on the release date to maintain the desired restrictions.

Stay tuned for more information and resources leading up to the April 16th launch. We are excited about these enhancements and the value they will bring to your data management and security efforts within Qlik.

Thank you for choosing Qlik,
Qlik Support

[CJ_Bauder]

This will be an excellent addition to round out the handling of sensitive data in Qlik SaaS. Thanks for the update!

[martingries]

Super news and perfect timing 😊

We're on the way into Qlik Cloud and we have tomorrow the session how to map the roles from QSoW to Qlik Cloud.

And yesterday we found out, that we have now the possibility to customize the Qlik Cloud Hub for our users.

Now we need only:

1. Subfolders in Qlik Cloud to store our QVD's etc.
2. SAP Connectors in Qlik Data Gateway (Report, BADI and Query Connectors)
3. More features in Qlik Tabular Reporting to have a good solution like NPrinting
4. Good Monitoring for Tasks in Qlik Cloud (heard that something will come soon)
5. Possibility to customize the behavior when you start an App (open in separate tab like QSoW)

Best regards

Martin

[Tom_MB]

Waiting a long time for it, but finally these are good news 😉

Only missing part please also provide the Logs who is downloading what... because in case of any data breech this can really helps...

[DataKnight1]

@Tom_MB 

I'm on Qlik Cloud - my team recently identified a bug on UK Tenants whereby an owner of a Data Space cannot be changed via UI @Sonja_Bauernfeind is this something you are aware of?

A solution to achieve this is qlik-cli.  I have my team looking into this in more detail. 

Initial feedback from my team is that qlik-cli will solve this issue, but could also be used to provide insights on what you have asked, eg; seeing who is downloading what - might be worth you/team investigating this further...

[ACorona]

Awesome, Cant wait to run some tests with these changes. 

[timherron]

We would like to block data exports for apps with sensitive data, but the users should be allowed to export from other apps.

Can the custom role be applied to individual apps? Or will it be applied on the user level, and those users cannot export from any apps?

[kogasawara]

Will capacity license basic users are able to export excel with the custom security rule?

[AlexOmetis]

@Sonja_Bauernfeind - this is fab news about the custom rules. As I understand it, the "has restricted view" is pretty much only used to limit data export, so is this role going away or will it serve another purpose? It seems to me it will be identical to "can view" after this change. 

@timherron - With the current "restricted view" (and the new custom one you'll need to create) they are applied to User Space permission, not to a User itself, so this way you can tailor permissions per Space - so you just need to make sure your sensitive data Apps are in Spaces with these restricted permissions. 

[Sonja_Bauernfeind]

Hello @DataKnight1 

I am reaching out internally about your query. 

[StephanieR]

Great news that this is rolling out.  How long until we see the rules added to restrict access to data connections.  
Steph