Manage Proxy Users

Proxy users enable secure, authentication and automated logins for integrations with Blackbaud CRM. Proxy users help centralize permission management and reduce security risks for automated processes. A proxy user is also known as a non-interactive user or NIU.

  • A proxy user is linked to an application user who serves as its proxy owner.

  • Proxy users inherit their proxy owner’s system roles and permissions.

  • Third‑party integrations and tools such as Report Builder use the proxy user’s display name, personal access token (PAT), and the client database to authenticate.

  • Proxy users don't have email addresses. They authenticate from other software rather than signing in to Blackbaud CRM directly.

To add or manage proxy users, go to Administration, Security, and then Application users. A list of users appears.

View application users and proxy users

The application user list shows both application users and proxy users. You can select which columns to show, including Is proxy and Proxy user owner. You can also filter the list to find specific users.

When you search for application use, you can select whether to Include proxy users in the results.

The Application User list will show unique proxy user names. You'll notice:

  • Login name (relabeled as Domain name in a Blackbaud ID environment) is the same as their unique username which is used for authentication. 

  • When a third-party software authenticates with Blackbaud CRM, it uses the proxy user display name along with the PAT and the Blackbaud CRM, Altru or ResearchPoint client database.

  • Proxy users are non-interactive and don't have email addresses.

View proxy users for an application user

When you view an application user's record, the Proxy Users tab appears. Select a proxy user name to open the proxy user's application user page.

View PAT information for a proxy user

When you open a proxy user, the Personal Access Token tab appears. It shows their personal access token (PAT) information, a summary, and the proxy owner.

Report Builder and SQL Server Reporting Services

Report authors can connect Report Builder to SQL Server Reporting Services (SSRS) in environments where Blackbaud ID is enabled for SSRS. Sign in as a proxy user with a personal access token (PAT). From there, create reports, open existing reports, and run reports. SSRS servers without Blackbaud ID keep Windows sign-in.

The proxy user needs a role that includes Report Builder rights. The SSRS roles in Blackbaud CRM appear only in Blackbaud ID environments. They are:

  • ReportAdmins: Browser, Content Manager, My Reports, Publisher, and Report Builder rights.

  • ReportContentManagers: Browser, Content Manager, and Publisher rights.

  • ReportBuilders: Report Builder rights only.

  • Report Publishers: Publisher rights only.

  • ReportBrowsers: Browser rights only.

The proxy user's name also needs to be unique across every environment on the same SSRS server. For naming guidance, see Add a Proxy User.

One set of credentials covers Blackbaud CRM and Report Builder. To add a token for Report Builder, see Add and Manage Personal Access Tokens (PAT) for Proxy Users.

Windows users

These Windows users remain:

  • BBJobUser,

  • Report User (which handles communication on the SQL side between Blackbaud CRM and Reporting services),

  • BBNCAppPoolUser,

  • and the OLAP user.