Power BI Report can be access via direct link without any direct or group permission -

[toutla]

One of my customers is able to open a Power BI Report when I send him a direct link to it, even though he has not been granted direct access nor is a member of any group with access.  Is this normal behavior or is there some setting allowing access via link without explicit permission?

[toutla · Accepted solution]

I had a second customer try to access the link and he received the expected "request access" dialog, so for now I think this is resolved.  I'll post again if I notice any additional issues.  Thanks everyone

[RajCZ]

I tried and and can't access.

[SaiTejaTalasila]

Hi @toutla,

Based on my support experience, the issue might be due to the following reasons:

1. Access Through a Security Group: You may have granted access to a security group, and the user is a member of that group.

2. Duplicate Reports: There could be two copies of the report, and the user has access to only one of them. Compare the report URLs—the one the user is opening and the one you have access to.

3. Organization-Wide Sharing: While sharing the report, you may have selected the option "People in your organization can view this report.

   I hope it will be helpful.

   Thanks,

   Sai Teja 

[lbendlin]

Are you sharing "to web" ?

[toutla]

We have published our report in the Power BI Service.  Then we simply copy a link from that UI and sent to someone who does not have permission to the report, either directly or via a group.  The person can open the report link directly, but cannot naviate to our Workspace since he does not have permission.   Below is that link...I am not sure if ANYONE can access it when using this link.  Any advice on how to secure this report would be appreciated.

https://app.powerbi.com/groups/6d337d13-fce5-4f05-8544-c85757775596/reports/c92445eb-25b5-4c8a-a826-... 

[SaiTejaTalasila]

Hi @toutla ,

On your report go to >manage permissions and check whether you have provided any access to people in your organisation as shown in the screenshot.

I hope it will be helpful.

Thanks,

Sai Teja 

[toutla]

Thanks Sai.  When I previously checked, there was no access directly to the report.  I did not use the "send link" function in PowerBi, but rather just copied a link from the Power BI Service UI and slacked it directly to that person.  It appears that when that person opened the link, Power BI interpreted that as me granting that person read access to the report (without adding them into the "Direct access" category).  That person appeared with read permission under the "Links" category.   I have now removed the link and will have them try to access again.   

[lbendlin]

Did you allow "Read Re-Share"  ?

[toutla]

Hi, I did not share via the "Send Link" dialog which has the share options.  Instead just copied the link from the Power BI Service UI and sent that to the person in slack.  I would expect the person to not be able to access the link unless I explicitly grant them access, but I think Power BI grants them read access if they click on that link.   

[lbendlin]

Yes, "read with reshare" is something that we "prohibit" in our company. You cannot technically avoid it (thanks Microsoft :-/) but we revoke Pro licenses if we catch developers doing that.