CIS.M365.9.1.2 - (L1) Restrict external guest invitations through Fabric
Overview
Guest invitations made through Fabric are disabled or limited to one or more security groups.
Restricting this invitation path reduces the chance that an unapproved user creates external access through content sharing. Other Microsoft Entra invitation controls remain separate.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under Export and sharing settings, find Users can invite guest users to collaborate through item sharing and permissions.
- Choose Disabled, or choose Enabled and scope the setting to Specific security groups with at least one group selected.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1136.003 Cloud Account |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.2, nist-800-53-r5:AC-2 |
| PowerShell test | Test-MtCisFabricGuestInvitationsRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.2.md