Thanks for your post!
If you use Roles to restrict access to a module, they will be unable to report on that module. But that also means that they won't be able to access the module at all.
Otherwise, if they have access to the module, they can, indeed, report on it.
If you're trying to make sure your users do not export data, you could also use Roles to restrict their ability to export, it should restrict the exporting of reports, as well as exporting from the record view, list view, etc.
You can read more about Roles here: https://support.sugarcrm.com/Documentation/Sugar_Versions/12.2/Sell/Administration_Guide/Role_Management/
Hope this helps!
Per Sugar Support:
Thank you for submitting a case with Sugar Support.
After reviewing your concerns, I wanted to share that disabling/hiding a module OR preventing access to a certain module (via role permissions) will not also block access to that module data when creating a report. In the event that a module is hidden or access is denied, the module is not entirely removed from the instance and the data is still available.
So even though the module is not displayed or available to access when navigating throughout the instance, the data is still accessible when creating a report. The only other work around to this matter would ultimately be preventing access to the Reports module as well so that your users cannot access the (hidden/prevented) module data.
If you have any further questions or concerns, please feel free to let me know. If not, I can submit an Idea with our product team (if you'd like) and then we can go ahead and close this case.
Interesting discussion, I have to say that I never checked if users could access records via reports if their role disabled access to a module.
I would encourage you to look into teams if you need to restrict access to records, although I agree this is quite surprising.
CRM & Digital consultant @ ITS4U Group
Brandon is right. I believe that I was thinking of our older version of reports.
I wonder what functionality your users are getting out of Reports that they could not achieve with list view filters. If most of the information they are looking for can be done with list view filters, it may be easier just to remove their access to reporting and have them defer to filters.
I also really like Francesca's idea above about using a combination of Roles and Teams.
I hope all this brainstorming is helping out. I'm happy to help get what you're looking for!
Sorry to blow up your notifications. I was talking to the team on Reports, and it seems like you may be experiencing Issue # 91071 ( portal.sugarondemand.com/ ) which is fixed in Sugar version 12.3. It may be worth upgrading a clone of your instance, assuming you are on the Sugar Cloud and seeing how things behave there.