Share with people, groups and guests

Share a report, chart, dataset, folder or workspace with people, groups or an email address, see who has access and why, and how roles and workspaces decide what they can do.

What someone can do with a report comes from three things: their role, where the report lives, and what's been shared with them. This page explains how they combine, and how to share something.

View, edit and manage

Access to an item has three levels.

Your role is the ceiling

A role sets the most someone can do anywhere, and what they get by default in workspaces open to the organization.

Someone who created an item manages it, up to their ceiling. A grant can raise a person's level but never past the ceiling: a Viewer granted edit access still only views. For the permissions behind each role, and custom roles, see Roles and permissions.

Open or private workspaces

A workspace's Who can find it setting decides who starts with access:

• The organization: everyone in the organization, within their role. Most reports live here.

• People it's shared with: only people it's shared with, and anyone a folder in it is shared with. Whoever made it, and Owners and Admins, always can.

Set it when you make or edit the workspace. See How Halo is organized.

Share something

Reports, charts, datasets, folders and workspaces each have a Share button.

1. Under Share with, choose a person or a group, or type an email address.

2. Under Access, choose Can view, Can edit or Can manage.

3. Choose Share, and they have it straight away.

Sharing takes the Share inside the organization permission and manage access to the item. You can't give more than you have. A role is still the ceiling, so a Viewer given Can edit can only view, and the dialog says so.

A member you share with gets a notification, and an email unless they've turned off Someone shares something with you. Sharing with a group doesn't tell anyone.

A report's dialog also has Copy link. Whoever opens the link signs in first, and it opens only if they have access. It says what they'll see: readers see the published version, and editors also see the draft. If a report has never been published, people who can only view won't see it yet.

Who has access, and why

The dialog lists everyone with access and the reason, such as "Shared on the Finance folder":

• what's shared on this item, and on the folders and workspace around it, with a link to that folder or workspace to change it there;

• whoever made it and what their role lets them do with it, and Owners and Admins, who can manage everything;

• people invited by email who haven't joined yet, with the role they're invited with and when the invitation ends;

• everyone in the organization if the workspace is open, or "Nobody else" if it's private.

The list is for roles that can see members. Anyone else gets the link and a plain line saying who can open it, and External guests don't get a Share button.

Take it back

Choose the × on someone's row, or change their level there. It works on their next request, and anyone with it open in an editor is out within a minute. Taking back the last thing shared with an invited External guest ends their invitation. If something's been shared with you and you no longer want it, choose Leave on your own row.

A member's page in Settings lists what's been shared with them directly, under Shared with them, and a group's page does the same under Shared with this group. Each change is in the audit log, with who made it, who it's for and the level.

Groups

A group is a set of members you treat as one, such as Marketing or Board. Manage them under Settings, Groups, which needs Manage groups (groups.manage).

Groups work in four places:

• Sharing. Share with a group as you would a person. See Share something.

• Invitations. Add someone to groups as you invite them. See Members and invitations.

• Scheduled email. Send to a group, and its members at each delivery get the report. See Scheduled email.

• Row policies. A policy can compare a field with the names of the groups someone belongs to. See Row policies.

How sharing inherits

Sharing something gives a member or a group a level on it. It works like this:

• It inherits downward. Sharing a workspace covers everything in it. Sharing a folder covers the folder, the folders inside it, and their contents.

• The highest level wins. Someone in two groups, one with view and one with edit, gets edit, up to their role's ceiling.

• It takes effect on the next request.

External guests

To share with someone outside your organization, type their email address under Share with. They're invited as an External guest, which needs the Share publicly or Manage members permission. Guests are always at Can view, since their role allows no more. They show as "Invited as an External guest" until they accept. The invitation names what you shared and expires after 7 days. A guest takes no seat, but counts toward your plan's limit on Viewers and External guests. See Usage and plan limits.

A guest signs in like anyone else, and sees what's shared with them and nothing else. Home lists it under Shared with you, and it's all that's in their lists. Any other item's address says it isn't found.

For people who shouldn't need an account, use a public link or scheduled email.

Sharing a chart without its dataset

Someone given a saved chart or a report doesn't need access to the dataset behind it, so you can share the answer and not the data. That holds for a guest, or a Viewer when the dataset is in a private workspace.

They see the chart, under their own row policies, and can read only what it asks for: not another grain or measure, not without its filters, and not more rows. The page has nothing to work on, with no fields, drilling, Explain, goals or copying, and the dataset's name is left out. Changing the chart still takes access to the dataset.

What a report can read

Anyone a report is given to, and any link to it, reach what the report names. So you can't save a report that adds data you can't open yourself: a new dataset, or more fields or filters on one. Halo says "This reads data you can't open. Ask someone who can open it to add it."

What's already in a report stays, so someone given edit on a report built on a private dataset can still change the rest. Placing a saved chart from the library takes edit on the chart, or being able to open its dataset. View lets you read a chart, not carry it out through a report and a link of your own.

Who sees which rows

Access decides who can open a report. Row policies decide which rows they get once inside. Two people with view access to the same report can see different numbers, and neither can see what a policy keeps from them.