Hello, When a user is authenticated to one org but the liveboard GUID belongs to a different org, ThoughtSpot renders a "You don't have access to this Liveboard." page inside the iframe, which has a 'back to home' button which gives users access to an embedded version of TS. Which we aboslutely don't want, is there a way to disable this access?

message has been deleted

Yes — you can prevent users from reaching non-embedded ThoughtSpot pages (like the in-iframe Home screen) by enforcing embedded-only access. For your case (user authenticated to Org A, Liveboard ID from Org B), the object-level access denial is expected, but you should also ensure non-embedded navigation is blocked. What to do: 1. Use Selective User Access (recommended) - In ThoughtSpot Admin, enable Selective User Access and restrict users to embedded experience only. - Per docs, this is the recommended control and overrides the older SDK behavior. 2. For older releases (10.5.0.cl or earlier) -

blockNonEmbedFullAppAccess

in Visual Embed SDK (v1.22.0+) is documented as

true

by default for blocking access to full app outside embed context. - But ThoughtSpot recommends moving to Selective User Access going forward. I could not find an SDK setting in the official docs that specifically says “hide only the Back to home button on the access-denied screen.” The documented control is to block access to non-embedded content at the platform/security level instead. If you want, I can give you a quick admin checklist for the exact settings to apply for embedded-only users.

i need to disable embedded access to more than the specific liveboard i've directed a user to

@spotter-code can you tell if we acn block/not show them certain pages while embedding and user should only be on certain pages from sdk ?

Yes — but this is controlled at the platform security level, not as a per-page SDK “allowlist.” What you can do: 1. Block non-embed full app access for embedded users This makes users access ThoughtSpot only within your embedded context (instead of navigating to full ThoughtSpot pages). 2. Optionally use Selective user access groups for exceptions (users allowed to access non-embedded ThoughtSpot). From the official docs: - “User access to non-embedded content” (block full app access / selective access) - “Selective user access” configuration page Both describe enabling Block non-embed full app access in security settings, and note this is configured by admins. Also, selective user access is currently not supported via APIs. So for your org-mismatch case, the supported mitigation is to enforce this security setting, rather than hiding only that specific “back to home” path via SDK.