Granting Default Reader Access to All Users Without a Role – DataHub Customer Support Portal

Area: Product Issues

Sub-Area: Access Control / Role Management

Issue

DataHub does not currently provide a built-in setting to automatically assign a default role (such as Reader) to users who have no role assigned. Administrators who want to ensure every user has at least baseline read-level access must use one of two supported workarounds: a group-based approach (leveraging SSO group sync) or a policy-based approach (creating "All Users" policies that grant Reader-equivalent privileges). It is important to understand that the policy-based approach grants the correct permissions but does not update the role label shown in the Users list — users will still display "No role" in the UI even though they have the equivalent access.

You Might Be Asking

How do I give every DataHub user Reader access without assigning roles one by one?
Can I set a default role for all users in DataHub?
I created policies for All Users but users still show "No role" — is something broken?
What is the difference between assigning a role to a group versus creating an All Users policy?
Will a policy-based Reader setup apply to new users who log in after the policy is created?

Solution

Choose one of the two approaches below depending on your environment and identity provider setup. The policy-based approach (Option 2) is recommended when you need coverage for all current and future users without any identity provider configuration.

Option 1 — Group-Based Approach (requires OIDC SSO with group sync)
A role assigned to a group is inherited by every member of that group. This approach is ideal if your identity provider (IdP) can send a universal group claim for all employees.
1. In your identity provider, ensure a group that contains every DataHub user is included in the OIDC groups claim.
2. In DataHub, navigate to Settings > Platform > SSO, open your OIDC configuration, and enable both Extract Groups and JIT Provisioning.
3. Have at least one member of that group log in. Once they do, the group will appear under Settings > Users & Groups > Groups.
4. Find the group, open it, and set its Role to Reader.
5. All current members of the group now inherit the Reader role. New users receive it automatically on their first login. Users who are already logged in must log out and log back in for the group assignment to take effect.
Note: This approach can also be used without SSO. Simply create a group manually in DataHub, assign the Reader role to the group, and add all users to it.
Option 2 — Policy-Based Approach (recommended; no IdP configuration required)
Creating "All Users" policies grants Reader-equivalent privileges to every current and future user automatically, with no manual updates required when new users are added.
1. Navigate to Settings > Permissions > Policies.
2. Review the built-in Readers - Metadata Policy and Readers - Platform Policy entries to identify which privileges are included. (These built-in policies cannot be edited directly.)
3. Click Create Policy and configure a new Metadata policy:
  - Set the actors to All Users.
  - Apply it to All assets.
  - Add the same privileges listed in the built-in Readers - Metadata Policy (e.g., View Entity Page, View Entity, View Dataset Usage, View Dataset Profile).
4. Click Create Policy again and configure a second Platform policy:
  - Set the actors to All Users.
  - Add the same privileges listed in the built-in Readers - Platform Policy.
5. Save and activate both policies.
Once active, all users — including those who have not yet logged in — will have Reader-equivalent permissions. No additional steps are needed as new users join.

Example privilege list for reference (verify against your instance's built-in Reader policies):
```
Metadata Policy Privileges (examples):
  - View Entity Page
  - View Entity
  - View Dataset Usage
  - View Dataset Profile

Platform Policy Privileges (examples):
  - View Analytics
  - Get Platform Status
```

Option 3 — Bulk Assignment via GraphQL API (best for one-time updates to existing users)

If you need to retroactively assign the Reader role to all existing users without a role, you can use the GraphQL API. The caller must have the Manage Policies privilege.

# Step 1: List all users and filter for those with no role assigned
query listUsers {
  listUsers(input: { start: 0, count: 100 }) {
    users {
      urn
      roles {
        role {
          urn
        }
      }
    }
  }
}

# Step 2: Bulk-assign the Reader role to users with no role
mutation batchAssignRole {
  batchAssignRole(input: {
    roleUrn: "urn:li:dataHubRole:Reader",
    actors: [
      "urn:li:corpuser:<user-urn-1>",
      "urn:li:corpuser:<user-urn-2>"
    ]
  })
}

This can be run as a scheduled script to cover users who join in the future. Replace <user-urn-1> and <user-urn-2> with the actual user URNs returned from the listUsers query.

Additional Notes

UI behavior with the policy-based approach: After creating All Users policies, users will still display "No role" in the Settings > Users & Groups > Users list. This is expected behavior — the role label in the UI reflects explicitly assigned roles only. The users do, however, have the full Reader-equivalent permissions granted by the policies.
Default role at sign-in: DataHub Cloud currently only assigns a role at SSO sign-in when the user has an active invitation with a role attached. Users signing in without an invitation receive no default role automatically.
Planned feature: A built-in default role setting is on the DataHub roadmap. See the Roles documentation for planned updates. No release timeline is available at this time.
Manual bulk update via UI: As a one-time alternative, you can go to Settings > Users & Groups > Users, select multiple users, and assign the Reader role in a single action. This is not automatic and must be repeated for new users.
These workarounds apply to both DataHub Cloud and self-hosted DataHub deployments.

Issue

You Might Be Asking

Solution

Additional Notes

Related Documentation