Sharing a custom report in Workday grants users permission to open and run the report definition,
but it never overrides Workday's underlying data security model. When a user runs a shared report,
Workday independently evaluates their security group permissions against four layers—the Report
Data Source (RDS), the Data Source Filter, each Report Field (in columns, filters, and
subfilters), and every component inside a Calculated Field—which is why two users running the
exact same report can see different row counts, blank cells, 0 values on numeric calculations, or
completely omitted columns.
1. How the Share tab and Authorized Users work
By default, a newly created custom report is private to its owner (and to administrators granted Modify access on the Manage: All Custom Reports domain in the System functional area). Note that Workday does not support sharing options on Simple reports; to share a report or deploy it as a worklet, it must be an Advanced, Matrix, Trending, Transposed, nBox, or Search custom report.
When editing a custom report on the Share tab under Report Definition Sharing Options, the options available to the report writer depend on which sharing domains their security group holds:
| Share Tab Option | Required Sharing Domain (System Functional Area) | Who Can Run the Report |
|---|---|---|
| Share Tab OptionDon't share report definition | Required Sharing Domain (System Functional Area)Custom Report Creation | Who Can Run the ReportOnly the report owner (and administrators with Manage: All Custom Reports). |
| Share Tab OptionShare with all authorized users | Required Sharing Domain (System Functional Area)Report Definition Sharing - All Authorized Users | Who Can Run the ReportEvery user who belongs to a security group with access to both the report's Data Source and its Data Source Filter. |
| Share Tab OptionShare with specific authorized groups and users | Required Sharing Domain (System Functional Area)Report Definition Sharing - Specific Groups and/or Report Definition Sharing - Specific Users | Who Can Run the ReportOnly the specific security groups and individual users you list in Authorized Groups and Authorized Users. |
Why a security group or user is missing from the Authorized Groups prompt
The Authorized Groups and Authorized Users prompts on the Share tab are pre-filtered by Workday: they only list security groups and users that already have domain security access to both the report's Data Source and its selected Data Source Filter.
Workday often secures an RDS and its built-in RDS filters under different security domains. For
example, a user's security group might have access to the Workers for HCM Reporting data source,
but lack access to the domain securing the Workers by Role data source filter. Furthermore, if you
share a report with specific Authorized Groups and later change the report's Data Source
Filter on the report definition, saving the report will fail with:
The entered information does not meet the restrictions defined for this field. (Authorized Groups)
Whenever that error appears, run View Security for Securable Item on the new Data Source Filter to see which security groups lack access to its domain.
2. Why shared users see empty columns, blank cells, zeros, or missing rows
Every symptom a shared user reports maps directly to a specific layer of Workday's security evaluation:
| Symptom Seen by Shared User | Exact Security Root Cause | How to Confirm and Fix |
|---|---|---|
| Symptom Seen by Shared UserAn entire column is missing from the report output | Exact Security Root CauseThe user does not belong to any security group with View access to the domain securing that Report Field. | How to Confirm and FixOpen the field's related actions (Security > View Security) or run View Security for Securable Item to identify the securing domain. |
| Symptom Seen by Shared UserA column header appears, but cells are blank on some rows and populated on others | Exact Security Root CauseThe user has Constrained security group access to that report field (for example, they can see their own Social Security Number, or base pay only for their subordinate organization, not peer organizations). | How to Confirm and FixRun Security Analysis for Securable Item and Account for the report and user to see which constrained group grants access. |
Symptom Seen by Shared UserA calculated field column shows 0 (numeric/currency) or blank (text/date/instance) | Exact Security Root CauseA user can only evaluate a calculated field if they have access to every underlying field referenced in the calculation (and its nested calculations). Without full access, Workday outputs 0 for numeric/currency fields and blank for all other types. | How to Confirm and FixInspect the calculated field definition (and Calculated Field Usage Hierarchy) and grant domain access to all source fields in the chain. |
| Symptom Seen by Shared UserFewer rows (instances) appear than when the report owner runs it | Exact Security Root CauseThe user's access to the Data Source (or to a field used on the Filter tab) comes from a Constrained security group (such as Manager or HR Partner scoped to a single Supervisory Organization). | How to Confirm and FixCompare the user's groups in View Security Groups for User against the RDS's securing domain. Note that a user's effective access is the union of all their security groups. |
| Symptom Seen by Shared UserReport fails at runtime with an error stating the user lacks access to a field | Exact Security Root CauseThe report uses a field on the Filter or Subfilter tab that the running user has zero domain access to evaluate. | How to Confirm and FixRead the field name in the runtime error and grant the user's security group View access to the domain securing that filter field. |
| Symptom Seen by Shared UserUser can view the report in the browser, but cannot export to Excel or PDF | Exact Security Root CauseSharing a report does not grant export privileges. The user lacks access to the Export to PDF and Excel domain in the System functional area. | How to Confirm and FixGrant View access on the Export to PDF and Excel domain security policy (note: Workday Extend grid exports are controlled by the grid component rather than this domain). |
3. Step-by-step diagnostic workflow for administrators
When a business user reports that a shared report is missing rows or columns, follow this four-step diagnostic sequence using Workday's delivered security audit reports:
- Inspect the item's securing domains: Run View Security for Securable Item (or select Security > View Security from the related actions menu on the Data Source, Data Source Filter, or Report Field) to list the exact Domain Security Policies and permitted security groups.
- Check the user's group memberships: Run View Security Groups for User for the affected worker to see every constrained and unconstrained security group they hold.
- Trace effective access for that specific account: Run Security Analysis for Securable Item and Account, entering the report (or specific report field / data source) as the Securable Item and the worker's account. This report pinpoints which security group grants the user access and whether that group is constrained by organization or role.
- Reproduce safely with Start Proxy: In a non-production tenant (Sandbox or Implementation), run Start Proxy as the affected user and execute the shared report to verify that the missing rows, blank cells, or calculated field zeros now populate as expected after updating the domain security policy (and running Activate Pending Security Policy Changes).
4. Preventing broken reports when transferring ownership
When a report writer changes roles or leaves the organization, administrators use the Transfer Ownership of Custom Reports task (secured by Manage: All Custom Reports and Custom Report Administration) to assign the report to a new owner.
Workday allows you to transfer a custom report to a new owner as long as the new owner has access to the Custom Report Creation (or Analytics Data: Report Fields and Values) domain and the report's Data Source and Data Source Filter—even if the new owner does not have security access to all the individual Report Fields inside the report! However, the moment that new owner opens Edit Custom Report and tries to save a change, Workday will block the save with field security errors.
Always run the Custom Report Exception Audit standard report before and after transferring report ownership. It flags custom reports where the owner lacks field-level access, alongside Custom Report Exceptions by Owner (which surfaces reports still owned by terminated workers).
How kiweely fits
Tracing why a single column or calculated field returns 0 or blank for a specific role requires
walking the report definition, every nested calculated field, and the domain security policies
attached to each field. Kiweely inspects your tenant's report definitions, calculated field chains,
and security domain mappings together so you can spot the exact missing permission or constrained
security boundary in seconds. Kiweely Personal is free for your Workday personal developer account and its tenant. Any other tenant needs a Personal licence, $99 a month, or a seat in your firm.
Frequently asked questions
Why does a numeric calculated field show 0 for a shared user when the underlying record has a non-zero value?
Workday's calculated field security requires the user running the report to have domain security
access to every source field referenced inside the calculated field. For example, if Extended
Amount multiplies Hours by Rate, and the shared user can view Hours but not Rate, Workday
suppresses the calculation and displays 0 for numeric or currency calculated fields (and a blank
cell for text, date, or instance calculated fields).
Can a user edit a custom report after I add them to Authorized Users on the Share tab?
No. Sharing a custom report on the Share tab only allows authorized users to run the report (and view or copy the report definition if they also hold report-writer permissions). Only the single Report Owner and administrators with Modify permissions on the Manage: All Custom Reports domain can edit and save changes to an existing custom report.
How do I hide a shared report from Workday global search when it is only used as a dashboard worklet or Composite subreport?
Open Edit Custom Report, go to the Advanced tab, and select Exclude Execution Link from Search under View Options. This hides the report from global search results for constrained users (unconstrained administrators and implementers can still find it) while allowing the report to run normally inside a dashboard worklet, embedded analytic, Worksheet data view, or Composite report.
Sources checked
- Workday Administrator Guide: Set Up Share Options for Custom Reports
- Workday Administrator Guide: Share Custom Report Definitions
- Workday Administrator Guide: Concept: Report Security
- Workday Administrator Guide: Concept: Calculated Fields Security
- Workday Administrator Guide: Reference: Security Domains for Reporting
- Workday Education: Report Security Course Manual