CIS.M365.9.1.8 - (L1) Restrict external sharing of semantic models
Overview
External sharing of Fabric semantic models is disabled or limited to one or more security groups.
This setting governs the in-place sharing of semantic models with users in another tenant. If misused, it can provide a path for data to be shared outside the organization. It is separate from OneLake external data sharing.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under Export and sharing settings, find Allow specific users to turn on external data sharing.
- Choose Disabled, or choose Enabled and scope the setting to Specific security groups with at least one group selected.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.8 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567 Exfiltration Over Web Service |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.8 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.8, nist-800-53-r5:AC-21 |
| PowerShell test | Test-MtCisFabricExternalSharingRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.8.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.8.md