(L1) Restrict service principal profiles in Fabric
CIS.M365.9.1.11MediumMicrosoft FabricDeveloper settingsPreview 3.0
Part of CIS · Microsoft Fabric · Developer settings · All checks
Invoke-Maester -TestId CIS.M365.9.1.11Overview
Section titled “Overview”Service-principal profile creation and use are disabled or limited to one or more security groups.
Profiles are used by multitenant applications to isolate customer contexts. Restricting this capability helps contain misuse of an application identity and protects those boundaries.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Developer settings.
- Set Allow service principals to create and use profiles to Disabled, or choose Enabled with Specific security groups selected and defined for the applications that need this access. If the organization doesn’t actively use this feature, keep it Disabled.
- Select Apply.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.11 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.11 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.11, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricServicePrincipalProfilesRestricted |
| Services | Azure |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.9.1.11.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.11.md