The permissions granted to user '' are insufficient for performing this operation.Mail will not be resent.

EDUARD SEREDIUC 0 Reputation points
2026-09-18T15:14:02.28+00:00

I installed Power BI Report Server – SQL Server 2025 Standard, product version 15.0.1121.109, on the primary node only of a Windows Failover Cluster SQL Server 2025 (no AG) – OS Windows Server 2025 Datacenter.

I configured the SMTP settings in the Email Settings section of the Report Server Wizard.

I created a shared PostgreSQL data source that connects using a username and password, and then created a paginated report using that data source.

The permissions for my AD user on the Report Server folder containing both the data source and report are all: Browser, Content Manager, My Reports, Publisher, Report Builder.

I created an Email distribution subscription for my report, but when I run the subscription either manually or on schedule I get the below error:

Failure sending mail: The permissions granted to user '' are insufficient for performing this operation.Mail will not be resent.

SQL Server Reporting Services
SQL Server Reporting Services

A SQL Server technology that supports the creation, management, and delivery of both traditional, paper-oriented reports and interactive, web-based reports.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-09-18T15:14:22.7166667+00:00

    This error is typically a Reporting Services authorization check failure during subscription delivery, not an SMTP configuration failure.

    For email subscriptions, Reporting Services may call AuthzInitializeContextFromSid when the email includes an embedded report or an attached report. It does this to verify that the user who created the subscription still has permission to view the report. If the Reporting Services service account cannot read the required Active Directory group membership information for that user, delivery can fail with access-denied behavior and the subscription is not sent.

    Recommended checks and fixes:

    1. Check the report server log for Authz errors.
      • Open the ReportServerService_<Timestamp>.log file.
      • Search for authz.
      • If the log shows AuthzInitializeContextFromSid or access denied, the failure is in authorization validation during subscription processing.
    2. Verify the Reporting Services service account.
      • Configure the Reporting Services Windows service to run under a domain user account.
      • This is one of the documented resolutions for AuthzInitializeContextFromSid failures during email subscription delivery.
    3. Grant the service account read access needed for subscription creators.
      • Reporting Services uses the service account security context to read the tokenGroupsGlobalAndUniversal (TGGAU) attribute for the user who created the subscription.
      • If that read is blocked, subscription delivery can fail.
      • Documented resolutions are:
        • Grant read permission for the domain user account on all users and groups in the domain, or
        • Grant read permission specifically on the user account or group that the subscription creator belongs to.
    4. If granting access on specific users or groups, use this path on a domain controller:
      • Open Active Directory Users and Computers.
      • Enable View > Advanced features.
      • Open the target user or group properties.
      • On Security, add the Reporting Services service account.
      • Allow Read permission.
      • Repeat for each user account or group that can create email subscriptions, if needed.
      • Changes may not take effect immediately.
    5. Confirm report server role assignments are still correct.
      • rsAccessDenied also occurs when a user lacks the required role assignment.
      • On a new installation, only local administrators have access by default. Access for other users requires explicit role assignments in the web portal.
      • Since the report and data source are already accessible interactively, this is less likely than the Authz issue, but it should still be verified.
    6. If the SMTP server requires authentication, verify the configured account has permission to send mail.
      • In Report Server Configuration Manager > E-mail Settings, confirm:
        • Sender Address is valid.
        • SMTP Server is correct.
        • The selected authentication method matches the SMTP server requirements.
      • If using Report server service account (NTLM), that service account must have Send As permissions on the SMTP server.

    A practical way to isolate the issue is to test a subscription created by a different domain user. If one user works and another fails, that strongly points to the Authz permission path for the subscription owner rather than SMTP.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.