App Permissions (strange Behavior)

Hi Khristian 

there are a few things worth checking:

1. Workspace access – Sometimes users get access through the workspace itself, even if they’re not in the app audience. Double-check the "Workspace access" list to make sure only the right people/groups are there.

2. Nested security groups – If you used security groups in your audience, there might be nested groups that include unintended users. A quick check in Azure AD could help spot this.

3. Admin bypass – Power BI admins (and sometimes other Microsoft 365 admins) can access content even if they’re not in the audience. Are these users in any admin roles?

4. Direct sharing – Someone might have shared a report or dashboard directly with them. You can check the "Shared with" tab on individual reports.

5. Published to web – If any content was accidentally set to "Public," that could explain it (though this seems less likely in your case).