---
title: "Reports"
description: "Built-in and custom reports on endpoints, patches, compliance, backups, credentials, and service, downloadable as PDF or CSV and delivered on a schedule."
url: "https://support.outpostplatform.com/reports/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Reports in the Outpost console: built-in reports, custom reports from the Report builder, and Schedules that email a PDF. Each client has All reports, Schedules, and Report builder on every plan; the MSP plan adds practice-wide reports and the Storage report. A report needs the permission of the data it reads. Permissions report:read, report:manage, report:schedule."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "report:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/reports/index.md"
license: "CC BY 4.0"
---

# Reports

Reports turn what Outpost knows about your endpoints, your service, and your
documentation into tables you can read on screen, download as a PDF or CSV,
and send to people on a schedule. Reports are included on every plan. This
page explains the kinds of report, who can run them, and how the MSP plan's
cross-client reports differ.

## Where reports live

Every client has a **Reports** section in the navigation rail with three
items:

| Item | What it is |
| --- | --- |
| **All reports** | The built-in reports as cards, and your saved **Custom reports** below them |
| **Schedules** | Reports that send themselves by email on a schedule |
| **Report builder** | Where you design a custom report |

On the MSP plan, practice level has its own **Reports** section with the same
three items, whose reports run across your clients, and a separate **Storage
report**.

## Kinds of report

**Built-in reports** ship with Outpost. You open one from its card on **All
reports**. Each client has these:

- **Executive summary**
- **Alert history**
- **Tickets and SLA**
- **Tickets by category**
- **Audit activity**
- **Remote access activity**
- **Policy compliance**
- **Credential health**
- **Credentials at risk after a departure**
- **Documentation expirations**
- **Discovery by site**
- **New devices**
- **SOC 2 compliance posture**, **HIPAA compliance posture**, **PCI DSS
  compliance posture**, **CJIS compliance posture**, and **ISO 27001
  compliance posture**
- **Backup coverage**

**Custom reports** are reports you design in the **Report builder**. A custom
report has one or more sections, and each section reads one dataset with the
columns, filters, grouping, and sort you choose. See
[Build a custom report](/reports/report-builder/).

**Schedules** send a built-in or custom report as a PDF attachment to up to 20
email addresses. See [Run and schedule reports](/reports/run-and-schedule/).

Every dataset a report can read is listed on
[Report datasets](/reports/datasets/).

## Who can run what

A report reads the same data the console shows, so it needs the same
permission. `report:read` opens the **Reports** section, but each report also
needs the permission of the data behind it: **Audit activity** needs
`audit:read`, **Credential health** needs `vault:read`, and so on. A card you
cannot run stays on **All reports**, dimmed, and says which permission it
**Requires**.

The two summary reports, **Executive summary** and, on the MSP plan,
**Practice executive summary**, need only `report:read`. They include what you
can see and name the sections they left out.

| Permission | Allows |
| --- | --- |
| `report:read` | Opening **Reports**, running reports, and reading saved reports and schedules |
| `report:manage` | Creating, changing, and deleting custom reports |
| `report:schedule` | Creating and changing schedules, and sending a schedule on demand |

By default, the **Owner** and **Support Manager** roles hold all three, and the
**Field Technician** role holds `report:read`. The **Support Rep** role holds
none, because a report is the whole estate on one page.

A schedule runs with its creator's permissions. If the creator is deleted or
disabled, or loses a permission the report needs, the schedule pauses and says
why.

## Limits

Reports stop at a row limit rather than running without end. Most datasets
read at most 5,000 rows per section, a few read fewer, and a few read more. A
report that hits a limit says so above the table, and a summary under a cut-off
table describes only the rows shown. A custom report can have up to 12
sections, each with a row limit of up to 10,000. A section's row limit can
lower its dataset's limit but cannot raise it.

## Reports across clients

On the MSP plan, the practice-level **Reports** section runs reports across
every client, or a set of clients you pick in **Clients**. Rows carry the
client's name, and a client that could not be reached is marked
**Unavailable** rather than left out. The practice-level reports include
financial, project, and sales reports built from your MSP business data. See
[Report datasets](/reports/datasets/).

The practice-level **Reports** page also holds **Client health thresholds**,
which set when a client turns amber or red on the **Client health across the
practice** report.

### Storage report

**Storage report** shows what each client stores. **Metered (Outpost Cloud)**
is storage Outpost operates, which is what appears on your Outpost invoice.
**Customer storage** is in a bucket the client owns, which Outpost tracks but
does not bill. Storage is recounted every few hours. The report needs
`billing:read`. See [Storage destinations](/depot/storage/).

## Related

- [Run and schedule reports](/reports/run-and-schedule/)
- [Build a custom report](/reports/report-builder/)
- [Report datasets](/reports/datasets/)
- [Password health and at-risk reports](/documentation/password-health/)