CIS.M365.9.1.4 - (L1) Restrict public publishing of Fabric reports
Overview
Publish to web is disabled, or scoped to one or more security groups with new embed-code creation disabled.
The check verifies that the setting has at least one security group and that new embed-code creation is disabled. It does not inventory or revoke existing codes.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under Export and sharing settings, find Publish to web.
- Choose Disabled, or choose Enabled, allow only existing embed codes, and scope the setting to Specific security groups with at least one group selected.
- Select Apply. Review existing embed codes separately and remove any that expose sensitive reports.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567 Exfiltration Over Web Service |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.4, nist-800-53-r5:AC-22 |
| PowerShell test | Test-MtCisFabricPublishToWebRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.4.md