Can an OPC Connection Be Set to Read-Only to Prevent Users from Writing to the End Device?

OPC Expert supports read-only access configurations that prevent writes from reaching the connected OPC server and the underlying end device. Access control can be enforced at the OPC server level depending on the server’s own security capabilities, and it can also be enforced at the OPC Expert layer using the Security Gateway module, which provides granular control over read, write, and browse permissions per user, certificate, or connection endpoint.

Write Access in OPC Expert’s Native Interface

OPC Expert’s standard configuration allows both reading and writing to OPC servers for users operating the interface directly. In the OPC to Excel context, writing is done explicitly by including a write parameter in the Excel formula. If the formula does not include a write argument, the cell only reads the value and no write is sent to the server. This means an Excel workbook designed purely for monitoring can be built without any write-capable formulas, effectively making it read-only by design without requiring a separate access control mechanism.

Enforcing Read-Only Access Through the Security Gateway

For environments where stricter enforcement is required, OPC Expert’s Security Gateway module allows administrators to define access policies that restrict write and browse operations at the connection level. Access rules are applied based on user credentials, Windows authentication, OPC user accounts, or X.509 certificates. A policy that grants read access only prevents connected clients from sending write commands regardless of what those clients attempt. This is relevant in scenarios where multiple users or applications connect to OPC Expert as a data source and only specific users should be permitted to modify process values.

OPC Server-Level Access Control

Many OPC servers, particularly OPC UA servers, support user-level access control natively. OPC UA nodes can be configured with access level attributes that restrict individual tags to read-only for certain user identities. When OPC Expert connects using credentials that are mapped to a read-only role on the server, write attempts to those nodes will be rejected by the server itself. This approach places the enforcement on the source server rather than on the client, which is the preferred pattern in security architectures that follow least-privilege principles.

Relevant Tools

OPC Security Gateway is the OPC Expert module that enforces granular access control over OPC connections. It allows administrators to restrict read, write, and browse operations per user, certificate, and endpoint, enabling read-only policies for specific clients or user groups without modifying the underlying OPC server configuration.

OPC to Excel is the OPC Expert module for Excel integration. Write operations in Excel workbooks are explicit and formula-driven, meaning a workbook that does not include write parameters in its OPC formulas will not send any data to the OPC server, providing a practical read-only behavior for monitoring-only deployments.

Summary

Read-only OPC behavior can be achieved in OPC Expert through multiple layers: designing Excel workbooks without write-enabled formulas, applying access policies through the OPC Security Gateway, or relying on access control enforced by the OPC UA server itself. The appropriate approach depends on the security requirements of the environment and whether the restriction needs to be enforced against all users or only certain ones.