Forum Discussion
Helper IISharepoint online data security
Don't forget that the connection user scope does not need to match the scope of the report user. In fact, this is one of the min causes for accidental oversharing (exactly the things that RLS is attempting to restrict).
To make matters even more interesting you can be given access to a file in a sharepoint but NOT to the actual sharepoint site. Now that is truly messed up 🙂
Super UserDon't forget that the connection user scope does not need to match the scope of the report user. In fact, this is one of the min causes for accidental oversharing (exactly the things that RLS is attempting to restrict).
To make matters even more interesting you can be given access to a file in a sharepoint but NOT to the actual sharepoint site. Now that is truly messed up 🙂
willatkinsonSo does this mean someone can view data in a report, even if they don't have access to the sharepoint site?
- lbendlin
Yes, if the connection owner has access.
- willatkinson
Oh ok thanks thats good to know. How do you configure this in the report in the PBI service?