Report and Dashboard Folder Access

Why Report and Dashboard Folder Access Matters

Reports and dashboards are how most Salesforce users consume data, and folders are the mechanism that controls who can find, run, edit, and manage that analytic content. In the Advanced Security and Access domain of the Advanced Administrator exam, folder access appears frequently because it sits at the intersection of two things administrators must balance: making insights widely available while preventing unauthorized users from editing or deleting shared assets. Misconfigured folder sharing leads to broken dashboards, overwritten executive reports, or sensitive summaries being visible to the wrong audience. An advanced administrator is expected to design a folder strategy that scales with the organization, aligns with roles and groups, and respects the fact that folder access and record access are two separate layers of security.

What Report and Dashboard Folder Access Is

Every report and dashboard in Salesforce lives in a folder. Folder access determines whether a user can see the folder, run or view its contents, create or modify items inside it, or manage the folder itself (rename, delete, and share it). Salesforce provides several folder categories:

• Private Reports / Private Dashboards – personal folders visible only to the owner. These cannot be shared.
• Public Reports / Public Dashboards (Unfiled Public) – default shared folders visible to all users who have permission to view public folders.
• Custom folders – administrator- or user-created folders that can be shared with specific users, roles, groups, or territories.
• Subfolders – in Lightning Experience, folders can be nested (up to three levels deep). Subfolders inherit the sharing settings of their top-level parent and cannot have independent sharing.

Salesforce offers two sharing models. Legacy folder sharing uses simple read-only or read/write access by roles or public groups. Enhanced folder sharing (the default in orgs created since Summer '13 and the model the exam assumes) introduces three granular access levels and finer sharing targets. Enhanced sharing is enabled in Setup under Folder Sharing; once enabled, reverting is not recommended because it changes how existing permissions behave.

How It Works: Access Levels

Under enhanced folder sharing, a folder can be shared with users, roles, roles and subordinates, public groups, territories, and territories and subordinates. Each share grants one of three access levels:

• Viewer – can see the folder, open and run reports, view dashboards, and refresh dashboards (if they have refresh permission). Cannot save changes to items in the folder, but can save a modified copy into another folder where they have Editor access.
• Editor – everything a Viewer can do, plus create, edit, save, delete, and move reports or dashboards into and out of the folder. Cannot change the folder's sharing.
• Manager – everything an Editor can do, plus rename or delete the folder and change who it is shared with and at what level. The folder creator automatically receives Manager access.

Access is cumulative: if a user receives Viewer access through a role and Editor access through a public group, the user has Editor access. Moving a report or dashboard into a different folder immediately changes who can access it, because access always comes from the folder, not the individual item.

How It Works: Supporting Permissions

Folder sharing only works alongside the correct user permissions, typically granted via profiles or permission sets:

• Create Report Folders / Create Dashboard Folders – allow users to create their own folders (they become Manager of those folders).
• Edit My Reports / Edit My Dashboards – allow users to edit reports or dashboards they created in folders where they have at least Viewer access.
• View Reports in Public Folders / View Dashboards in Public Folders – required to see the Public Reports and Public Dashboards folders.
• Manage Reports in Public Folders / Manage Dashboards in Public Folders – grant Manager-equivalent access to all public and shared folders, regardless of explicit sharing. These are powerful and should be limited to administrators or analytics owners.
• Create and Customize Reports / Create and Customize Dashboards – allow building new content; Report Builder and Report Builder (Lightning Experience) allow use of the builder interfaces.
• Manage All Private Reports and Dashboards – lets administrators access items in other users' private folders, useful when an employee leaves.
• Subscribe to Reports / Subscribe to Dashboards – govern scheduled delivery; a user must still have access to the folder to subscribe.

How It Works: Dashboards, Running Users, and Record Visibility

Folder access controls whether a user can open a report or dashboard. It does not control which records appear. Reports always honor the viewing user's object permissions, field-level security, and sharing rules, so two users with Viewer access to the same report may see different results. Dashboards behave differently: a standard dashboard displays data as its running user, so a Viewer may see data they could not otherwise access through reports. A dynamic dashboard runs as the logged-in user and respects each viewer's own record visibility. To view a dashboard, a user needs access only to the dashboard folder, not necessarily to the folders holding its source reports; to edit the dashboard, however, the user needs Editor access to the dashboard folder and access to the source reports.

Designing a Folder Strategy

Advanced administrators typically share folders with public groups or roles and subordinates rather than individual users, so access adjusts automatically as people change positions. A common pattern is a Sales Leadership folder shared with the VP Sales role and subordinates at Viewer level, a Sales Ops folder shared with a public group at Editor level, and an Admin-owned top-level folder structure where only administrators hold Manager access. Subfolders are used to organize content within those boundaries without creating additional sharing to maintain.

Exam Tips: Answering Questions on Report and Dashboard Folder Access

1. Separate folder access from record access. If a question says users can open a report but see no records, the fix is sharing rules, OWD, or field-level security, not folder access. If users cannot find the report at all, the fix is folder sharing or the View in Public Folders permission.

2. Match the verb to the access level. Run or view = Viewer. Create, edit, save, delete, or move items = Editor. Rename folder, delete folder, or share folder = Manager. Look for the exact action the scenario requires and choose the least privilege that accomplishes it.

3. Remember what cannot be shared. Private folders cannot be shared, and subfolders cannot have sharing separate from their parent. If a question asks how to share a subfolder differently, the answer involves creating a new top-level folder.

4. Prefer groups and roles over individual users. When a scenario emphasizes scalability, turnover, or minimizing maintenance, select public groups or roles and subordinates rather than sharing with named users.

5. Recognize the powerful permissions. Manage Reports in Public Folders and Manage Dashboards in Public Folders override folder-level sharing. If a non-administrator can edit everything despite folder settings, check these permissions. If a question asks how to restrict a user, removing these is often the correct step.

6. Watch for running-user traps. If Viewers of a dashboard see more data than they should, the issue is the running user, and the solution is changing the running user or converting to a dynamic dashboard, not adjusting folder access.

7. Know the creator's default rights. The person who creates a folder is its Manager. Users who create a report in a folder can edit it if they hold Edit My Reports even with only Viewer folder access.

8. Departing users and private content. When content in a former employee's private folder must be recovered, the answer is the Manage All Private Reports and Dashboards permission, not transferring ownership or recreating the reports.

9. Eliminate distractors. Options referencing Modify All Data, profile object permissions, or sharing rules as solutions for folder visibility are usually wrong. Options referencing legacy read/write access are wrong when the org uses enhanced folder sharing.

10. Read for the word public. Access to the Public Reports or Public Dashboards folders requires the View Reports in Public Folders or View Dashboards in Public Folders permission, and content placed there is visible to every user with that permission, which is often the reason a question describes unintended broad visibility.

Mastering these distinctions lets you answer folder access questions quickly and confidently, and more importantly, design an analytics security model that keeps shared insights accurate, protected, and easy to maintain.