CIS.M365.9.1.3 - (L1) Restrict guest browsing of Fabric content
Overview
Guest browsing of Fabric content is disabled or limited to one or more security groups.
Scoping this setting limits the Fabric content that an external identity can discover through browsing. It does not revoke workspace roles or direct item permissions already granted to guests.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under Export and sharing settings, find Guest users can browse and access Fabric content.
- Choose Disabled, or choose Enabled and scope the setting to Specific security groups with at least one group selected.
- Select Apply. Review existing guest workspace and item permissions separately.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.3 |
| Severity | Low |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1213 Data from Information Repositories |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.3, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricGuestBrowsingRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.3.md