You need to ensure that managers can successfully run reports. What should you do?

SSRS accessing a remote data source on behalf of a Windows-authenticated user involves two authentication hops - from the client to SSRS, then from SSRS to the data source. NTLM cannot forward credentials across network hops, so Kerberos constrained delegation must be configured on the SSRS service account to impersonate users when connecting to the data source. Without this, SSRS fails to authenticate the second hop and managers cannot retrieve report data.

Storing Windows credentials in the data source would use a fixed service account rather than the individual manager's identity, which undermines per-user security and would not resolve a delegation failure.

Forms-based authentication replaces Windows authentication entirely and does not resolve the Kerberos double-hop problem for back-end data source access.

The CustomData property passes an extra string token to a data source for row-level security filtering; it does not address authentication delegation failures.