Forum Discussion
Helper IIUsers gained unauthorized access to reports!!! How to stop them?
Here it is the support team response.
It is not possible to restrict users from opening some of the repots sharing same semantic model. Actually, giving read access to the semantic model (which is required for the reports to work) automatically gives access to *ALL* the reports sharing the same semantic model. This is by design, they say.
I will have to develop a way to deny users access to undue reports using RLS features, somehow. Maybe using OLS. We'll see..
Community SupportHi iW1DOV,
Based on our understanding, organization wide or specific people share links might still grant report access even when users do not have workspace access or explicit report permissions.
Kindly follow the below steps which may help to resolve the issue:
1.Check each affected report and paginated report, and remove any existing People in your organization or unintended links. Also review the semantic model permissions, since report sharing links tied to the semantic model can also grant access.
2.Ask your tenant admin to review tenant settings such as "Allow shareable links to grant access to everyone in your organization" and external sharing settings. Also ensure that "Allow access to hidden content" is disabled in App audiences, because hidden content can still be opened through direct URLs if this option is enabled.
If users can still open unauthorized reports, the issue might be related to the shared semantic model architecture itself, particularly with paginated reports and shared datasets. In such a case, we kindly request you to open a Microsoft Support ticket so that the support team can inspect effective backend permissions and inherited access paths in detail using the link:Microsoft Fabric Support and Status | Microsoft Fabric
Additionally, kindly find the below links for reference:
Share and Collaborate on Power BI Reports and Dashboards - Power BI | Microsoft Learn
Manage Semantic Model Access Permissions in Power BI - Power BI | Microsoft Learn
Export and sharing tenant settings - Microsoft Fabric | Microsoft Learn
We hope the information provided helps to resolve the issue. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.
Thank you.
iW1DOVHi v-pnaroju-msft , thank you.
I was assessing the situation with the customer. We triple-checked permissions on workspace and reports, and no one has access to other reports than they have to. Users have only access to due reports via the app.
We audited access to some of most sensible report and it turned out that some users gained access to those wia the Onelake catalog. where all reports are listed!So, definitely we will raise a ticket to solve the main problem: users accessing undue reports via links, but we think also onelake access has to be restricted ASAP - but I don't know how rto do so: can you provide some guidance on this matter, please?
Thank You!
Gianfranco