Forum Discussion
how to disable ANONYMOUS LOGON
Ok, so if you have Windows auth setup, but you only allow a subset of your users to access the home folder in PBIRS any other users will see the following browser prompt, this is a standard browser response to a 401 (access denied) challenge
If I access my dev server using an inprivate window I get the prompt above. And if I then do as you suggest and click signin without entering any credentials it gives me the same message you see:
‘Could not load folder contents
You are not allowed to view this folder. Contact your administrator to obtain the necessary permissions.'But this has not logged me in as anonymous or given me access to any reports or folders. It comes up with the error in a modal dialog which cannot be dismissed. And if you check the networking tab in the browser tools all the requests for report content return 403 (forbidden) errors.
So this is really just a custom access denied page - it's not actually logging in the anonymous user or giving them access to anything. I don't believe there is any way to change this - you'd probably have to raise a support ticket with Microsoft to get an engineer to look into this.
The way we prevent this from happening at my work is that we have added the "Domain Users" group with browser permissions to the home folder. Then we put all our reports under one of the top level folders and all security is controlled on the top level folders. So anyone without access to any reports just sees an empty page and no one ever gets prompted for credentials.
Authentication is through windows authentication, so as the report server is in the domain, authentication is by domain joined users who have been allowed in powerbi.
We have permissions setup with domain groups and it works fine, there is no access to anonymous users throughout the setup. Windows anonymous access is also blocked by default and I have checked secpol and registry to make sure.
However PowerBi is allowing anonymous users in, which happens if no credentials are entered in the signin box and the signin button is clicked. Once the button is clicked I can see the user name in the top right hand corner says NT AUTHORITY\ANONYMOUS LOGON and a message comes up saying
‘Could not load folder contents
You are not allowed to view this folder. Contact your administrator to obtain the necessary permissions.'
This is something that’s against our company standards hence the ask if it can be disabled and how
Ok, so if you have Windows auth setup, but you only allow a subset of your users to access the home folder in PBIRS any other users will see the following browser prompt, this is a standard browser response to a 401 (access denied) challenge
If I access my dev server using an inprivate window I get the prompt above. And if I then do as you suggest and click signin without entering any credentials it gives me the same message you see:
‘Could not load folder contents
You are not allowed to view this folder. Contact your administrator to obtain the necessary permissions.'But this has not logged me in as anonymous or given me access to any reports or folders. It comes up with the error in a modal dialog which cannot be dismissed. And if you check the networking tab in the browser tools all the requests for report content return 403 (forbidden) errors.
So this is really just a custom access denied page - it's not actually logging in the anonymous user or giving them access to anything. I don't believe there is any way to change this - you'd probably have to raise a support ticket with Microsoft to get an engineer to look into this.
The way we prevent this from happening at my work is that we have added the "Domain Users" group with browser permissions to the home folder. Then we put all our reports under one of the top level folders and all security is controlled on the top level folders. So anyone without access to any reports just sees an empty page and no one ever gets prompted for credentials.