If you use Roles to restrict access to a module, they will be unable to report on that module. But that also means that they won't be able to access the module at all.
Otherwise, if they have access to the module, they can, indeed, report on it.
If you're trying to make sure your users do not export data, you could also use Roles to restrict their ability to export, it should restrict the exporting of reports, as well as exporting from the record view, list view, etc.
If you use Roles to restrict access to a module, they will be unable to report on that module. But that also means that they won't be able to access the module at all.
Otherwise, if they have access to the module, they can, indeed, report on it.
If you're trying to make sure your users do not export data, you could also use Roles to restrict their ability to export, it should restrict the exporting of reports, as well as exporting from the record view, list view, etc.
Thank you for submitting a case with Sugar Support.
After reviewing your concerns, I wanted to share that disabling/hiding a module OR preventing access to a certain module (via role permissions) will not also block access to that module data when creating a report. In the event that a module is hidden or access is denied, the module is not entirely removed from the instance and the data is still available.
So even though the module is not displayed or available to access when navigating throughout the instance, the data is still accessible when creating a report. The only other work around to this matter would ultimately be preventing access to the Reports module as well so that your users cannot access the (hidden/prevented) module data.
If you have any further questions or concerns, please feel free to let me know. If not, I can submit an Idea with our product team (if you'd like) and then we can go ahead and close this case.
