Forum Discussion
Kudo CollectorSuddenly seeing share/reshare links on every report causing non-authorized users to have access
Hi mostvp123,
That is the main way of creating links.
Can you see who is making the links as I mentioend in my previous post? That will help narrow down, if all the links are being made by one person, likely that person is clicking the share popup to copy a link and is making them by mistake.If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Super UserHi mostvp123 ,
I have tested on my side and the reports do not have any links except if I created them.
On that specific view were you are showing the link it has a column that shows who created the links is there any user or is Admin?
Did you Admin changed any settings on the Admin Portal, or the workspaces?
To my knowledge this type of links need to be created mannually, but I can be mistaken and something may have changed.
Kudo CollectorThank you for checking!!!
Yes there is our admin user, but she has not created any links, we have 100+ reports and all of them suddenly have the link visible and it seems to be the person who created the app, although we never tick the box which allows resharing. Its all very weird...
On this point: "Did you Admin changed any settings on the Admin Portal, or the workspaces?" - what kind of settings could create such links?
AMD0791Advocate IV
Is this issue occurring in just this workspace and the reports for just this workspace app? Or is it occurring across the tenant? Have you confirmed the permissions for the workspace and app are limited as expected?
Have you checked with the person who created the link and determined if they might have done it accidentally through sharing? You may need to actually observe their workflow to determine where something could have happened. Have they been sharing through sharepoint and inadvertantly creating the org links that way?
Has anyone been creating Organizational Apps? These apps are implemented differently and give users access to the actual artifacts. I don't see a way to share these apps with the entire org at this time, but maybe that was possible in the past?
It takes a lot of discipline and diligence to avoid the reshare tick box -- it is sometimes enabled by default and it wouldn't be hard for someone to miss it while going through their normal workflow. You also might want to check the usage metrics on these reports and confirm that you don't have unexpected users consuming these reports.
The most likely source is some sort of human action. I can't even find an API endpoint that would create these links. If you remain convinced that nobody in your org did this by hand, then maybe submit a ticket to microsoft and see if they can at least get you more information on when and how these were created. If one user account created all these links and that user has no idea how it happened, then it may be a worthwhile safety step to have them update their password in case it's been compromised.
If these links are a concern for your organization, I would strongly suggest updating the tenant admin settings to disable the ability to create these links, or limit it to just a couple of people.
There is an API to get the list of these links to help clean it up and monitor. I think you need to be a tenant admin to run it or use a service principal with comparable permissions.
There is also a separate endpoint in the fabric api to facilitate removing these links in bulk. I've never used it, so I can't speak to how well it works