Microsoft SSRS - Can users view a report based on a database they have no permissions to?

Question

I'm having trouble understanding the report server permissions mechanism.

If I were to create a report based on a database, would other users be able to view it even though they have no permissions over the database?

In my company, we are very strict with how user policy work with databases, so only specific users have logins to databases.

If I use one of those users to create a report and then publish it over SQL Report Server, as long a user has permission to a specific site where the report lies, can he still view the report even though he has no assigned logins on the database?

Is the report server keep collecting the data for the report using the report creator's permissions? Like when it live updates?

Answer 1

It's up to the report author whether to store credentials for the data source or to run the report using the current user's identity.

If you select "Use current Windows user" then the user must have access to the data source. If you store credentials for the data source, then the user only needs access to the report, not the database.

Both options are useful in different scenarios.