CIS.M365.9.1.7 - (L1) Restrict organization-wide Fabric links
Overview
Organization-wide Fabric sharing links are disabled or limited to one or more security groups.
An organization-wide link can grant access to tenant users who were not individually granted access. Restricting who can create these links reduces accidental internal disclosure; it does not govern external guests.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under Export and sharing settings, find Allow shareable links to grant access to everyone in your organization.
- Choose Disabled, or choose Enabled and scope link creation to Specific security groups with at least one group selected.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.7 |
| Severity | Low |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.7 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.7, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricOrganizationLinksRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.7.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.7.md