CIS.M365.9.1.12 - (L1) Restrict service principal access to Fabric global APIs
Overview
Service-principal access to create Fabric workspaces, connections, and deployment pipelines is disabled or limited to one or more security groups.
These APIs are not governed by Fabric's item permission model. Scope the setting to a group containing only applications that require access; this check confirms a group is configured but does not inspect its membership.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under Developer settings, find Service principals can create workspaces, connections, and deployment pipelines.
- Choose Disabled, or choose Enabled and scope the setting to Specific security groups containing the applications that need this access.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.12 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.12 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.12, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricGlobalApiAccessRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.12.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.12.md