Why does the student balance export not display to screen?

The BrightArrow Low Balance1 - Student query is meant to be a simple export. Simply check the box to select all fields, name the file, name the export and schedule. And when doing so it's always a good plan to display to screen. Sometimes, however, display to screen reports an error. 

We recommend continuing with the process and saving and scheduling as normal. When scheduling click the send now button as well. Sending will likely still work.

Why is the display not working?

Since it sends why doesn't it display to the screen? The issue is field level security (FLS). In many cases field level security will prevent you from using the PowerQuery at all. In those cases the option will show up in the drop down as grayed out and you will not be allowed to select it. In this instance the issue allows you to use the PowerQuery, just not display the results.

What is the difference between when FLS blocks the entire query vs just blocking the display to screen option?

Field level security is attempting to make sure people don't see information beyond their security level. The difference comes from if the field is an option to select or not.

1. If the field being protected is a field that can be selected in the export:
   Block the entire PQ from being selected by this user
   
2. If the field being protected is NOT a selectable field but IS used in the query somewhere
   Allow the PQ but do not display results to the screen

So there's a field being used but not displayed?

Yes. In the past schools have needed to set different cut off points for who gets a low balance based on their lunch status and the only way we could do that was to send us the field and we'd evaluate on import. However Lunch Status is NOT a field we should have and we only sent it in situations that required it. Even if you wanted to create multiple exports with the DEM filters doing the work you'd still need to include the field in the list because only fields in the export list can be filtered on.

This had always made us uncomfortable. Instead we've added custom fields in the filters area that allow you to set your cutoffs. Maybe everyone has the same cutoff, you can do that. But if you have a setup where a balance is low at $10 for paid students and $4 for reduced students and you don't want to send any low balances at all for free students you can do that in the filters. This query will evaluate your settings and send us only that it's considered Low or Negative or Extreme Negative and not the reason why. To do that the query evaluates the status but doesn't send it. This is what FLS is detecting.

For more information on those settings: How to Change the Low/Negative Balance Rules

OK, but that still doesn't explain why it sends

Displaying to the screen is done by the user and follows that user's permissions. Scheduled exports are run by the system which is not restrained by FLS. No one can have access to a field that the system doesn't have access to, the system has access to everything. So since the issue isn't actually a query issue but a security issue and that doesn't apply to the system it's able to send anyways.

Does this mean it's not safe to send?

In this case it's safe. You can see in the PowerQuery (full details of the query display in Plugin Management whenever you install a plugin with a PowerQuery) that we evaluate and do not send the status ever. This is perfectly safe.

At the same time we do not wish to speak about everyone's queries. It could be that someone has written a query to evaluate a field and call it something else to try and get around the security and it really will display whatever field is supposed to be protected. This is why it's good that you can't install a query without a plugin, it forces visibility. While it is likely that all your queries are safe, we do not wish to act as if all are.

Another thing to consider is why is the field protected. Just because it is doesn't mean it's not safe to put in the export. Lunch status in an export going to an outside lunch system is valid. And not all protections are done because the school wants them, the state reporting team may have done it as well. For example North Carolina blocks the field students.gender from everyone so the field can't even be entered. However it's in our basic export, so is it a problem since no data can be entered anyways? 

For these reasons we encourage you to evaluate any query you want. In this case we are letting you know why the field is used and how it's not displaying, but feel free to verify for yourself if you have any doubts.

There are grayed out BrightArrow queries in the list, are they safe to use?

The original method to get this data was to include it in the students/parents queries. At the time we thought fewer queries would be better and adding 4 was a lot. Since then we've had many requests to make the queries easier to use and to add functionality. As we did this the query count grew and that encouraged us to break out the balance exports into their own. However, it's going to take some time to move everyone off the old queries and onto the new ones and so the old queries still exist. The recommendation is to not use them anymore as we'd like to retire them, but they are safe to use. If someone has access to the fields that are blocked from you they can set up an export from those queries that doesn't contain the blocked field. That won't make the template editable for you but it also won't send the protected info either.

Still nervous?

Feel free to contact us at gettechsupport@brightarrow.com