Suddenly seeing share/reshare links on every report causing non-authorized users to have access

[mostvp123]

This morning we noticed that all of our reports, which we usually provide access to via an App, have share/reshare direct access links on them as below in the workspace:

We noticed the links work for users who don't have access to the app, and if the report does not have RLS set up this can result in a data breach, not to mention Reshare appears to be enabled.

When did this happen? We definitely never created these links and as mentioned they are on every single report now.
This is a hugely concerning issue and can cause a data breach. Is anyone experiencing the same thing? Is this some kind of default link that we never even realised was there? We never grant access to individual reports in workspaces and always use the App side of things, but after testing, the links definitely work for people outisde the workspace if RLS is not enabled.

[v-karpurapud]

Hi @mostvp123 

Just checking in as we haven't received a response to our previous message. Were you able to review the information above? Let us know if you have any additional questions.

Thank You.

[v-karpurapud]

Hi @mostvp123 

I wanted to check if you’ve had a chance to review the information provided. If you have any further questions, please let us know. Has your issue been resolved? If not, please share more details so we can assist you further.

Thank You.

[v-karpurapud]

Hi @mostvp123 

Thank you for submitting your question to the Microsoft Fabric Community Forum, and thanks to @MFelix , @tayloramy  and @AMD0791 for offering helpful suggestions.

Could you let us know if the suggested solution resolved your issue?If you still need help, please share more details so we can assist you further.

Thank you.

[AMD0791]

We have seen this happen if someone uses the "Share" button that brings up dialog below,  and then clicks the "Copy link" option, even without adding people or clicking "Send".  Some users were doing this inadvertantly when they wanted to copy/paste the report link to give it to someone and they thought they were just copying the URL to the report.   If your tenant settings allows that user to create organizational links, the result of the "copy link" option will be an organizational link with reshare enabled.  There could be a similar "glitch" when sharing apps.

The better short-cut to just pass along the link to a report is to right-click on the report link in the workspace list and choose "copy link".

We have also updated our tenant settings to limit the ability to create organizational links to just a few users.  Unfortunately,  someone on that list is prone to accidentally creating these these when they just want to copy/paste the link.

[mostvp123]

We never use that pop up. Are there any other ways that sharing links can be created, or is this it?

[tayloramy · Accepted solution]

Hi @mostvp123, 

That is the main way of creating links. 

Can you see who is making the links as I mentioend in my previous post? That will help narrow down, if all the links are being made by one person, likely that person is clicking the share popup to copy a link and is making them by mistake. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution. 

[tayloramy]

Hi @mostvp123, 

I've also never seen links like this get created automatically. 

On that manage permissions screen, you should be able to see who made the link:

 This might help narrow it down. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution

[MFelix]

Hi @mostvp123 ,

I have tested on my side and the reports do not have any links except if I created them.

On that specific view were you are showing the link it has a column that shows who created the links is there any user or is Admin?

Did you Admin changed any settings on the Admin Portal, or the workspaces?

To my knowledge this type of links need to be created mannually, but I can be mistaken and something may have changed.

[mostvp123]

Thank you for checking!!!
Yes there is our admin user, but she has not created any links, we have 100+ reports and all of them suddenly have the link visible and it seems to be the person who created the app, although we never tick the box which allows resharing. Its all very weird...

On this point: "Did you Admin changed any settings on the Admin Portal, or the workspaces?" - what kind of settings could create such links?

[AMD0791]

Is this issue occurring in just this workspace and the reports for just this workspace app?  Or is it occurring across the tenant?  Have you confirmed the permissions for the workspace and app are limited as expected?

Have you checked with the person who created the link and determined if they might have done it accidentally through sharing?  You may need to actually observe their workflow to determine where something could have happened.  Have they been sharing through sharepoint and inadvertantly creating the org links that way?

Has anyone been creating Organizational Apps?  These apps are implemented differently and give users access to the actual artifacts.  I don't see a way to share these apps with the entire org at this time, but maybe that was possible in the past?

It takes a lot of discipline and diligence to avoid the reshare tick box -- it is sometimes enabled by default and it wouldn't be hard for someone to miss it while going through their normal workflow.  You also might want to check the usage metrics on these reports and confirm that you don't have unexpected users consuming these reports.

The most likely source is some sort of human action.  I can't even find an API endpoint that would create these links.  If you remain convinced that nobody in your org did this by hand, then maybe submit a ticket to microsoft and see if they can at least get you more information on when and how these were created.  If one user account created all these links and that user has no idea how it happened,  then it may be a worthwhile safety step to have them update their password in case it's been compromised.

If these links are a concern for your organization, I would strongly suggest updating the tenant admin settings to disable the ability to create these links, or limit it to just a couple of people.  

There is  an API to get the list of these links to help clean it up and monitor.  I think you need to be a tenant admin to run it or use a service principal with comparable permissions.

Admin - WidelySharedArtifacts LinksSharedToWholeOrganization - REST API (Power BI Power BI REST APIs...

There is also a separate endpoint in the fabric api to facilitate removing these links in bulk.  I've never used it, so I can't speak to how well it works

Sharing Links - REST API (Admin) | Microsoft Learn