Forum Discussion
Helper IIUsers gained unauthorized access to reports!!! How to stop them?
Here it is the support team response.
It is not possible to restrict users from opening some of the repots sharing same semantic model. Actually, giving read access to the semantic model (which is required for the reports to work) automatically gives access to *ALL* the reports sharing the same semantic model. This is by design, they say.
I will have to develop a way to deny users access to undue reports using RLS features, somehow. Maybe using OLS. We'll see..
Helper IHello iW1DOV
I believe this is actually expected behavior, not a bug.
What’s happening is tied to Build permission on the semantic model. If users have Build, they can access any report connected to that dataset, even if they don’t have explicit access to the report or workspace.
It also explains why you don’t see anything under “via link”. The access isn’t coming from sharing, it’s inherited through the dataset.
To fix this, you need to remove Build permission from those user groups. You can do that by going to the semantic model → Manage permissions → Direct access / Advanced, and removing those users/groups or unchecking Build.
Also worth checking tenant settings to limit link sharing (“anyone with the link”) if that’s enabled.
Once Build is removed, the links alone won’t work anymore.
Best Regards,
Luis Oliveira