How to restrict data source editing to specific users

This article explains how to manage segregated data source permissions in the Admin Center.

Segregated data source permissions

Without permissions, a data source can be edited by all tenant admins and owners and a data source can be viewed by all space owners. Applying permissions to a data source prevents unauthorized editing of the data source structure and the data. The granular control over data sources, ensures that only authorized users have edit permissions. 

Setting up permissions

1. When creating a new data source you have the ability to limit the edit access of the data source:
   
   • When Restrict edit access is disabled (default setting), all tenant owners and admins will be able to edit this data source. Space owners (who are not a tenant owner or admin), can only view this data source.
   • When Restrict edit access is enabled, you can define who should get edit access to the data source:                                                   
2. After clicking the Create button, you can edit the permissions.
   The list of 'Users', displayed on the left, contains all tenant owners, tenant admins and space owners. On the right you see the 'Editors'. When creating a new data source for specific admins, the creator will be an editor by default. By moving users to the 'Editors' section, these users will get edit access to the data source:
3. Click Save.

Access restrictions on a data source can be edited at all times by clicking Restrict edit access which you can find behind the three dots:

Data sources with restricted edit access will be marked with a shield (marked red above) behind the data source name. 

Bulk edit restrict access

You can edit the restricted access for multiple data sources at once. The restricted access will then be applied to the selected data sources. Select all data sources you want to edit and then click Manage edit access:

Permission matrix

The following matrix will provide a better understanding of the impact of the different permissions for the three roles.