Forum Discussion
Helper IIUsers gained unauthorized access to reports!!! How to stop them?
Here it is the support team response.
It is not possible to restrict users from opening some of the repots sharing same semantic model. Actually, giving read access to the semantic model (which is required for the reports to work) automatically gives access to *ALL* the reports sharing the same semantic model. This is by design, they say.
I will have to develop a way to deny users access to undue reports using RLS features, somehow. Maybe using OLS. We'll see..
Community SupportHi iW1DOV,
Based on our understanding, the behaviour may be related to effective permissions and discoverability through the OneLake catalog rather than workspace access alone. The OneLake catalog itself may not independently grant access, however, it surfaces items based on the user's existing effective permissions. Therefore, if a user can open a report from the OneLake catalog, there may still be some underlying permission path allowing access, such as direct or inherited report permissions, semantic model permissions, related item inheritance, App propagation, or existing share links.
At this stage, as suggested, we request you to open a Microsoft Support ticket so that the support team can investigate backend effective permissions, inherited access chains, catalog discoverability behaviour, and hidden sharing paths.
Additionally, kindly refer to the link below:
OneLake catalog overview - Microsoft Fabric | Microsoft Learn
We hope the information provided above helps to resolve the issue. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.
Thank you.
iW1DOVWe are currently in touch with Microsoft Support, let's see if they will be able to solve our issue