Here is a query I came up with which only shows the unique permissions (root folder and wherever folder security inheritance is broken) instead of listing out every report catalog item. This layout is easier to read for things like access reviews if you have a lot of reports. Tested with SQL 2014.
Note: as mentioned by Paul this will show what is assigned in SSRS but isn't aware of if an Active Directory account is disabled or has been deleted.
select
[Path] =
case
when r.RoleFlags = 1 and c.Path is null
then N'-Site Settings-'
else
case
when c.Path = N''
then N'/'
else c.Path
end
end
, MemberName = u.UserName
, r.RoleName
, RoleDescription = r.Description
--, pur.PolicyID
, RoleType = --Roles.RoleFlags values are from SecurityScope enum. Used to interpret Roles.TaskMask field.
case r.RoleFlags
when 0 then 'Folder Security'
when 1 then '-Site Settings-'
when 2 then 'Model Item'
else concat('Unknown: ', r.RoleFlags)
end
, ReportServerName = @@SERVERNAME
, ExecTime = getdate()
--, r.RoleFlags
from ReportServer.dbo.PolicyUserRole pur
inner join ReportServer.dbo.Users u on pur.UserID = u.UserID
inner join ReportServer.dbo.Roles r on pur.RoleID = r.RoleID
--get the root catalog item for each policy
outer apply (
select top 1 c.Path, c.Name
from ReportServer.dbo.Catalog c
where pur.PolicyID = c.PolicyID
and r.RoleFlags = 0 --Catalog items
order by len(c.path) - len(replace(c.path, N'/', N'')) --get the highest level items where this policy is applied. Children that inherit from here will have more "/"s than the parent.
, c.path
) c
order by
RoleType,
c.Path,
u.UserName,
r.RoleName
;