Users are able to open the scheduled update reports even though the reports are outside of their scheduled update window.

Users are able to open the scheduled update reports even though the reports are outside of their scheduled update window.

If you want to disable this functionality for any security reason or organization policy then you can configure your Spotfire server to block end-user access to scheduled update reports when the reports are not scheduled.
This feature is available from Spotfire version 7.11 onwards, so you need to upgrade your existing Spotfire environment to 7.11 or later version. If you are on Spotfire version 7.11 or later, then follow below steps to implement this restriction:

1. On the Spotfire Server machine, open a command line as an administrator and change the directory to the location of the config.bat file (config.sh on Linux).
 
The default location is <server installation dir>/tomcat/bin. This is where you execute commands.

Export the active server configuration (the configuration.xml file) by using the "export-config" command. 

Example:
config export-config --tool-password=mypassword

2. On the command line, enter the following command to set the value of a specific configuration property.

config set-config-prop --name=scheduled-updates.performance.deny-open-when-not-scheduled --value=true

3. Import the configuration file back to the Spotfire database by using the "import-config" command.

Example:
config import-config --comment=name of your choice

4. Restart the Spotfire Server service.

Note: This configuration applies to all scheduled update files. It has no effect on files that are not managed by scheduled updates. https://docs.tibco.com/pub/spotfire_server/7.11.0/doc/html/TIB_sfire_server_tsas_admin_help/GUID-8C420392-68FE-4704-A017-9B08646B4E9B.html