Permission Role | Reports Permission - Create Report

[DavidRaykovitz]

I am finding a discrepancy in the behavior of a checkbox between our Production (Release: 2411.20250306044843) and Staging (Release: 2411.20250306044843)
environments for reasons unknown. 

Intent: We'd like to be able to extend access to the Report Center for supervisors throughout our organization so that they can run Performance related reports specific to the employees they directly supervise.  

The problem: On our Staging environment, the Permission Role we set up behaves as expected.  On our Production environment, it does not.  Specifically, we want to grant the following Reports Permission under User Permissions when editing the Permission Role: 

• Report Center
• Schedule Reports
• Analytics Tiles and Dashboards (All)
• Run Report (All)

We explicitly want to deny the following permission in the same area:

• Create Report

On Staging, checking/unchecking the Create Report box has the intended affect - the "NEW" button becomes visible to the user in the Report Center depending on the setting in the Permission Role (checked = visible, unchecked = not visible).  

On Production, despite not having the Create Report box checked, users can still se the "NEW" button when navigating the Report Center (see 2nd screenshot below).  What's more, clicking on "NEW" will open the window allowing the user to create a Canvas report, and even when cancelling out of this option, a user who clicked "NEW" will now permanently see the View Report Center tile, even when all Reports Permissions have been disabled (clicking the tile when permissions are turned off will present a "you do not have access" message, but it seems like the tile is permanently visible to that user if they ever clicked the "NEW" button to create a report).  

I've tried to explore available permissions for individual users, but can't find any indication that they have permission to create reports, yet, they can if the other Report permissions we've extended are made available.  Having access to Report Center is all they need to have enabled in order to see the "NEW" button to create reports.  

The question: Why am I able to disable the Create Report permission as expected on our Staging environment, but not for our Production environment?  Can the Create Report permission be granted by anything other than the Permission Role | Reports Permission?  Should I be looking at other Permission Roles to see where we might already be extending this permission?  That seems like a longshot, as turning off all Report Permissions in the Permission Role I've recently set up does take away the Report Center access.  

Thanks!

[DavidRaykovitz · Accepted solution]

The problem seems to have stemmed from some legacy permissions control for Canvas reports.  While the setting for System Administration/Manage Workforce Analytics/Functional and Option Permissions was toggled into the "On" position, toggling it off and back on again seemed to "unstick" the unintended permission to create a NEW report.  

❓ Use SFSF RBP role to maintain Workforce Analytics Functional and Option permissions (rather than Reporting & Analytics Role). Prerequisite for this switch to be enabled is the Provisioning switch “WFA/WFP/talent insight Integration – Single Sign On (SSO)” must be ON.

Enabling Functional and Option Permission for Canvas Report