By default when a user chooses to share a document, a selection has already been made to share that document with anonymous access, restricted organizational access or only with specific people (requiring entry of recipients) depending on who set up your tenant. If no changes were made, chances are the links default to anonymous access. A user can change this setting to restrict access before sharing but for newer users in a hurry, it’s likely anonymous links could be being created and shared incidentally because time isn’t being taken to review the alternative options.
Here’s how you, as an administrator, can change the default settings to something more secure without (or with) removing anonymous capabilities.
One of my favorite features of Power BI is the ability to have published reports automatically refresh data on a schedule. This is great for “setting and forgetting” your reports, knowing wherever you publish them they will be showing the most recent data for your clients. I feel like it used to be depending on your license, you could be limited to how frequently you can refresh (max of once per day), but you can refresh nonetheless. And this may have changed, as I couldn’t find (in my brief search) any confirming statement.