Permission grants are integral to keeping your data secure. As an organization Admin, you have control over who has access to your connection's data in Sigma at each level of the connection tree. This means you can grant users full access to a connection or individual schemas, or you can limit their access to only certain warehouse tables.
Sigma's broader permissions and sharing model also protects data access at the Dataset, worksheet, and dashboard levels. However, this article will focus primarily on permissions to connections, schemas and warehouse tables.
Summary of Content
- You must be an organization Admin to assign or revoke connection data permissions.
When you add a warehouse connection to Sigma, you and your fellow Admins have access to all warehouse data granted per that connection. All other users must be granted full or partial access permissions to the connection data.
The only exception to this is if you are running a Snowflake connection using OAuth for permission inheritance. Learn more.
Permissions are Additive
Permissions in Sigma are additive. If you grant an organization member permission at the connection level, they will subsequently have the same level of permission on all underlying schemas and Tables. Similarly, if you grant them permission to access an individual schema, that permission will cascade down to all Tables in the schema.
These inherited permissions cannot be revoked at the inherited level. For example, if you only want a user to have access to three of four Tables in a schema, you will need to grant them access to each Table individually. If you instead grant access at the schema level, there will be no way for you to restrict access to that one remaining Table.
Teams and Individuals
Permission grants can be given to teams or to individual organization members. In addition to their individual permissions, organization members inherit all permissions granted to their team(s).
For new organizations, we recommend creating teams prior to granting data permissions. This allows you to grant permissions in bulk to defined teams. Learn more about teams.
Organization members with this permission type can view Table data and create referencing Sigma datasets and workbooks.
Can Use & Annotate
Organization members with this permission type have all the privileges of Can Use and Can Update access. They can also annotate Tables (e.g. hide columns, add column descriptions, create links to other Tables, etc). Annotations are local to Sigma, and are not reflected back to you warehouse.
Grant Permissions to a Table
- Open you Connection from the left hand navigation panel.
- Open your connections target warehouse Table through the connection tree.
- Open the Table's Permissions tab.
- Click Add Permission Grant.
- Search for the team(s) or individual member(s) you would like to grant permissions to.
- Select a permission to grant. You can grant Can Use, Can Update, or Can Use & Annotate. Users with annotation permissions can edit descriptions and column descriptions on tables.
- Click Save.