Does sharing a dashboard also share its database connection?

Viewers read the dashboard's data through its connection without a grant on the connection. Editing the dashboard's queries needs access to the connection itself.

Does object-level access apply on the desktop?

No. A desktop installation has one user, who owns everything; object grants apply to server installations.

Can an Analyst administer a single connection?

Yes. A Manage grant on one connection, storage connection or mail profile lets that Analyst edit its settings and secret, and nothing else.

What is the difference from row-level security?

Object-level access decides whether a person can open a project, dashboard or connection at all. Row- and column-level security decides which rows and columns they see inside a project.

Object-level access and sharing | ATX AnalyticsTable Docs

Object-level access and sharingPer-object permissions on a server: share one project folder, dashboard, database or storage connection or mail profile with named people and Entra ID groups. Roles decide what kind of work a person may do; object-level access decides on which objects. On a server installation of ATX AnalyticsTable, a single project folder, dashboard, database connection, cloud-storage connection or mail profile can be shared with named people, Microsoft Entra ID or SCIM groups, app roles, everyone holding at least a given role, or a service token — at View, Edit or Manage, or denied outright.

Overview

Roles decide what kind of work a person may do; object-level access decides on which objects. On a server installation of ATX AnalyticsTable, a single project folder, dashboard, database connection, cloud-storage connection or mail profile can be shared with named people, Microsoft Entra ID or SCIM groups, app roles, everyone holding at least a given role, or a service token — at View, Edit or Manage, or denied outright.
Every object starts open, so nothing changes until an owner or administrator restricts it. A restricted object disappears from the lists, the folder browser and the AI assistant of everyone it was not shared with, and every refusal and every change of access is written to the audit trail. Which rows and columns a person sees inside a project is decided separately, by row- and column-level security.
Manage access to the open project, and (administrators) the access review: Settings → Settings → Set / Restore → Access

Sharing one project, dashboard or connection

On a server installation the three roles say what KIND of work a person may do; object access says on WHICH objects. A project folder, a dashboard, a database connection, a cloud-storage connection or a mail profile can be shared with named people, groups from Entra ID or the SCIM directory, app roles, everyone holding at least a given role, or a service token, at one of four levels: VIEW, EDIT, MANAGE — which also decides who has access — or DENY, which beats every other grant.
The role stays the ceiling: a Viewer granted Edit can still only view. Administrators are never limited by grants; when one opens a restricted object they were not given, the audit trail records it. Every object starts OPEN, so everyone keeps what their role gives them, until its owner or an administrator switches Restricted on in Manage access. From then on only the people and groups listed have access, and the object disappears from everyone else's lists, folder browser and AI assistant.
A grant on a project folder applies to every project inside it. Whoever creates a project, dashboard, connection or mail profile on a server becomes its owner and can share it, and a grant can expire on a date. Manage access is on each saved connection and mail profile in Settings, in a dashboard's header, and for the open project under Settings → Access. There administrators also find the access review — every grant in force, downloadable as CSV for periodic certification — and Check access, which explains what a given person would get on an object and why.
An installation can make a kind of object restricted until shared, and push locked grants, through its machine policy. Every refusal and every change of access is in the audit trail. On the desktop there is one user, who owns everything, so none of this applies there.

Access levels

View — Open and query the project — Open the dashboard and its data — Read data or files through it — Send or read mail through it
Edit — Also save it and write its tables — Also save or delete it — Also write data or files into it — Same as View
Manage — Also decide who has access — Also decide who has access — Also change its settings and secret, and decide who has access — Also change its settings and decide who has access
Deny — Overrides every other grant — Overrides every other grant — Overrides every other grant — Overrides every other grant
The role stays the ceiling: a Viewer granted Edit can still only view, and an Analyst can reach at most Manage. Administrators are never limited by grants; when one opens a restricted object they were not given, the audit trail records an administrator override.

Who a grant can name

user:<object id or sign-in name> — One person
group:<group id> — Members of an Entra ID or SCIM group
approle:<value> — Holders of an Entra app role
role:<viewer, analyst or admin> — Everyone holding at least that role
token:<name> — A service token used by automation
everyone — Every signed-in person
A grant can carry an expiry date and a note. A grant on a project folder applies to every project beneath it, so one grant can share a whole team folder.

Share an object step by step

1. Open Manage access for the object: on a saved connection or mail profile in Settings, in a dashboard's header, or for the open project under Settings → Settings → Set / Restore → Access.
2. Switch Restricted on. From then on only the people and groups listed have access; everyone else stops seeing the object.
3. Add people or groups — the field suggests names from the directory — and choose View, Edit, Manage or Deny for each, with an optional expiry date.
4. Save. The change applies to the next request and is recorded in the audit trail.
You cannot remove your own Manage access by mistake: the server refuses a change that would lock out the person making it, unless they are an administrator.

Access review and Check access

Administrators find two tools under Settings → Access. The access review lists every grant in force across the server and downloads it as CSV for periodic access certification. Check access explains, for a given person and object, which level they get and why — the role ceiling, the grants that matched, and any deny or restriction.

Policy for a whole installation

Through the machine policy an administrator can make a kind of object restricted until shared — for example every database connection — and push locked grants that owners cannot remove. Whoever creates a project, dashboard, connection or mail profile on a server becomes its owner with Manage access.

Common questions

Does sharing a dashboard also share its database connection? — Viewers read the dashboard's data through its connection without a grant on the connection. Editing the dashboard's queries needs access to the connection itself.
Does object-level access apply on the desktop? — No. A desktop installation has one user, who owns everything; object grants apply to server installations.
Can an Analyst administer a single connection? — Yes. A Manage grant on one connection, storage connection or mail profile lets that Analyst edit its settings and secret, and nothing else.
What is the difference from row-level security? — Object-level access decides whether a person can open a project, dashboard or connection at all. Row- and column-level security decides which rows and columns they see inside a project.

Glossary terms on this page

KPI dashboard: definition

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.