Preventing sharing via browser URL

[bevizzled]

We've been trying to understand why our usage stats include people who should not have access to some of our reports.

On investigation, it looks like some users who did have viewing rights for a report copied the browser URL, and then shared that with colleagues (i.e. bypassed the fact that they did not have the sharing option in the report itself). Recipients then seems to be able to open the reports as usual.

This seems like a huge security risk; is there a setting in the Admin portal that could prevent this, for example creating a more secure URL in the browser? There is no way I can prevent people from copying a browser URL in the first place.

[djurecicK2]

Ok- not sure why that is happening.

For read only distribution, you might want to create an app and share that app with the read only users.

Here is some additional information:

https://radacad.com/ultimate-sharing-strategy-power-bi-apps

[djurecicK2]

Ok. What about "Manage Access" in the workspace?

[bevizzled]

No, we also checked workspace permissions, including sharing permission. That is not it.

[djurecicK2]

Hi @bevizzled ,

 The report URL only works if the user has access to the report. I would look at the workspace and report permissions. 

To check the report permissions, you can go to ... to the right of the report and select "Manage Permissions"

To check the workspace permissons, you can go to "Manage Access" from the workspace.

[bevizzled]

That is what we thought, but these people are definitely not in the list of people who have permission in 'Manage permissions' (and there are no groups, only individuals, so that is not the issue), but still, they can open the report from the shared broswer URL. In some cases, the can open the report and not see the visuals (error messages where the visuals should be); in other casesit seems like they have full interaction. We are still trying to determine why this difference might exist.

PS: Also, none of the users in the permissions list have sharing rights.