CIS.M365.9.1.9 - (L1) Block resource-key authentication for Fabric datasets
Overview
Resource-key authentication is blocked for Fabric streaming and push datasets.
Resource keys are shared credentials rather than individual identities. Blocking them reduces reliance on reusable keys and improves attribution for API access.
Remediation action
- Sign in to Microsoft Fabric with a Fabric administrator account.
- Select OneLake catalog > Govern > Configurations > Tenant settings. If these options aren't available in your region, select Settings > Admin portal > Tenant settings.
- Under Developer settings, find Block ResourceKey Authentication and set it to Enabled.
- Select Apply and update any clients that still send data with resource keys to use identity-based authentication.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.9, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCisFabricResourceKeyAuthenticationBlocked |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.9.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.9.md