Pro · Lesson 8 of 9
Groups, data permissions, collection permissions, sandboxes, and the audit log decide who sees which rows.
Sign in to save your place.
Administration is the door list. Groups are the clubs. Data permissions say which tables a club may read. Collection permissions say which folders of questions they may open. A sandbox is a rule that a person only sees their own rows, even on a table the club can query.
Put people in groups. Grant access to groups, not to a long list of individuals. Data permissions control the database: which schemas and tables a group can view, and whether they can build native SQL or download results. Collection permissions control the saved content: view or curate.
A person can be allowed to query a table and still be blocked from a collection. Both layers have to say yes before they see a chart that uses that table. Admins bypass these layers. Keep the admin group small.
| Permission | Controls | Typical grant |
|---|---|---|
| Data access | Tables and native SQL | Analysts on the models schema |
| Download | Export of results | Only groups that need a file |
| Collection curate | Who can edit questions | The team that owns the folder |
| Collection view | Who can open questions | The readers of that team |
A sandbox, sometimes called row-level security in the product, adds a filter Metabase enforces for a group. Use it when one table holds many customers and each user may see only their rows. Test with a user in that group. An admin preview is not the test, because admins are not sandboxed.
SSO with SAML or JWT, sandboxes, and the audit log are paid features. The audit log answers who viewed or changed what. Turn it on when the data is sensitive enough that you will be asked. Impersonation, where Metabase connects to the warehouse as a database role that matches the viewer, is another paid path. Use it when the warehouse, not Metabase, should be the enforcement point.
A group that can download results can walk away with those rows. Turn download off for groups that only need to look.
People go into groups, groups get data permissions, and the audit trail shows what happened.
Step 1 of 3Add users to groups. Permissions are given to groups, not to individual people.
Admin → People → Groups → Finance
Step 2 of 3For each group and database, decide whether they can query it, use only the query builder, or write their own SQL.
Admin → Permissions → Finance → Warehouse → Query builder only
Step 3 of 3Usage analytics (on Pro and Enterprise) shows who viewed, created or changed questions and dashboards.
Usage analytics → Activity log
Create a group that can view one collection and one schema, and cannot download. Sign in as a user in that group. Confirm a curated question opens and a question in another collection does not. If you use sandboxes, confirm another customer's key returns no rows.
Checked against vendor documentation in October 2026. Screens and plan names still change, so confirm the control in your own instance.