SQL Server Reporting Services Permissions for TFS 2013

SQL Server Reporting Services (SSRS) Setup

Some teams would like to be able to create and upload their own reports.  Following a similar approach for multiple teams in one collection/team project approach a folder called _Teams under the team project folder was created.

Under the team folder will be folders for each team who want custom reports.  The permissions Microsoft says to grant are admin level permissions.  Because of this they will be restricted to SG.TFSTeamAdministrators security group.  The rest of the team will still be able to view the reports.  This is done ONCE on the _Teams folder.  No further action is required to maintain this.
 

Report Builder Setup

The Report Builder button was not showing up for the users.  After further research a Microsoft article was found that had some basic setup information in it.  I was hesitant at first but after seeing other posts about the missing button I pulled the trigger and created a new role assignment at the system level.  It grants System User to all of the collections users.  We have an AD group for this so that was used.  This was granted in the report manager application as well by clicking on the Site Settings in the upper right corner and going to the security section.

This was probably an omission in the TFS Setup instructions because it is custom and not needed for TFS to publish reports (no need for Report Builder). 

SQL Server Analysis Services Setup

The next step is granting permissions for SQL Server Analysis Server.  The Microsoft article written for TFS 2013 details the permissions needed for both the relational data warehouse and analysis cube.  Because this grants permissions at a collection level, it will be restricted to a security group you have created that contains all of the team administrators for TFS.

• For the database you will need to create the login for the group at the instance level and then assign it the roles on the Tfs_Warehosue database.
   

• Make sure when adding a group to check the box for searching those objects.  It is not checked by default.  his tip applies to the database and the cub (Analysis Services) permissions.