Updates to Qlik Cloud Security Roles

[Sonja_Bauernfeind]

On April 16th, 2024, Qlik is launching a highly anticipated capability: custom security roles.

What do custom security roles do?

Custom security roles introduce fine control of data export and access permissions within Qlik apps. This allows you to tailor permissions to your specific needs, enhancing data security and compliance.

The first delivery on April 16th includes the capability to control who can export content. Additional capabilities will be added soon after, such as who can create data connections, reports, and similar.

What does this mean for me?

As part of this update, the existing "has restricted view" space role will gain the ability to export data to Excel. This adjustment is in line with Qlik's capacity-based pricing model, ensuring basic users have essential tools.

If you do not wish for users with the "has restricted view" space role to be able to export data, you will need to edit the User Default role to deny download for all users, and then create a custom role that allows if for specific users and groups.

Stay tuned for more information and resources leading up to the April 16th launch. We are excited about these enhancements and the value they will bring to your data management and security efforts within Qlik.

Thank you for choosing Qlik,
Qlik Support

[Sonja_Bauernfeind]

Hello @mgranillo 

I'd recommend giving it another test and telling us what the exact issue is you're facing, as it's difficult to make a statement without more information.

All the best,
Sonja 

[Daniele_Purrone]

Hi @robert99 ,

the feature was indeed introduced because it requested by customers. 
We always aim at improving the platform and its implementation, so... if you have any suggestion, please post it on the Ideation page so that it can be brought up to the attention of product management.

As for the fact that the custom rule does not work, from my testing it might take some minute before the information is synced.
If you still have issues, please make a separate post on the community, and we can investigate it.

[robert99]

Hi @Daniele_Purrone 

Thanks for the reply

"the feature was indeed introduced because it requested by customers"

Just to be clear. The Customers wanted to be only able to restrict email downloading by User. Not by User and Space. Or did Qlik misunderstand what the Customers were requesting?

My View as a Customer (and developer and User) is clear

Qlik is an outstanding product. I much prefer it to PBI

But the Space's Roles current set-up is not the best way to do this

The best solution is to instead let Customers set up their own Space roles. Rather than Qlik trying to guess the mix of roles that Customers want.

Its not to introduce a new set of roles by Users that ignores (the excellent) Spaces. This limits what Customers can do. And introduces a set of new roles by Users in a completely different location. That seems unneccesary and confusing. Users need to be allocated a Space role anyway. So why not do it all here. Using Customer set-up roles. 

Anyway that my view. I can work with whats been done but now it just seems more confusing. With less options.

[Witney_Araujo]

Qlik Cloud is getting better and more robust.

[Hirschner_Viktor]

Great!
Is there a plan for RBAC-based access to specific Data Connections as well?
Currently, a user has access to either all or none of the DCs in a given Space.

[Daniele_Purrone]

Hi @Hirschner_Viktor , I couldn't find anything specific on that subject.
Please suggest an idea about anything that you'd like to see in the platform, so that our Product team can consider it.

[DataKnight1]

Hi all,

I need some guidance/assistance from the experts!

1)  I need to remove access to installation of the Qlik mobile app.  This, by default, is installable on notification / alerting emails.  Can this be done?

2) If this cannot be done, what can be done to prevent access to tenant if someone does install the app and attempts to access?

Thanks

[CJ_Bauder]

@DataKnight1 They should still be required to Auth in through the mobile app even once installed. In our case, we even have Office365 Mobile and Use Entra as SSO and still are required to Auth in on mobile when accessing the app.

[DataKnight1]

@CJ_Bauder thanks - my team have carried out testing and have observed what you have said re; authenticating.  However, is there a way to remove the links from the alert email distributed from Qlik?  Or, failing this, a way to prevent access from the app?  If a business does not have an appetite for analytics to be consumed via mobile devices, then what steps are there available?

[CJ_Bauder]

@DataKnight1 There is probably no way to remove the links as that'd require modifying the cloud infrastructure on Qlik's side - very unlikely. 

I'd try two methods - unconventional as they are.

1. See if it is possible to use MS Exchange to block certain hyperlinks, then block the hyperlink into that specific app on Apple/Playstore in any email. Probably the easiest.

2. Block download of that specific app to the phone via the Control allowed by corporate access to a phone. Often times companies require control/wipe capabilities when installing corporate email on a personal phone. Not even sure if this is possible to also control certain apps, and it would probably be hard if so.