CIS.M365.9.1.5 - (L2) Disable R and Python visuals in Fabric
Overview
R and Python visuals are disabled for the Fabric tenant.
These visuals execute scripts when reports render. Turning off the tenant setting reduces the code-execution surface in reports; Microsoft does not provide a security-group scope for this setting.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under R and Python visuals settings, find Interact with and share R and Python visuals.
- Set the control to Disabled, then select Apply. This setting applies to the entire organization and can't be limited to groups.
- Identify reports that depend on these visuals and move them to an approved alternative.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.5 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Tenant settings |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1059 Command and Scripting Interpreter |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.5 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:9.1.5, nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCisFabricScriptVisualsDisabled |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.5.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.5.md