# (L1) Restrict service principal profiles in Fabric

Service-principal profile creation and use are disabled or limited to one or more security groups.

Source: https://maester.dev/docs/tests/CIS.M365.9.1.11

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Microsoft Fabric · Developer settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.9.1.11
```

## Overview

Service-principal profile creation and use are disabled or limited to one or more security groups.

Profiles are used by multitenant applications to isolate customer contexts. Restricting this capability helps contain misuse of an application identity and protects those boundaries.

#### Remediation action

1. Sign in to the [Microsoft Fabric admin portal](https://app.powerbi.com/admin-portal) with a Fabric administrator account.
2. Select **Tenant settings**.
3. Scroll to **Developer settings**.
4. Set **Allow service principals to create and use profiles** to **Disabled**, or choose **Enabled** with **Specific security groups** selected and defined for the applications that need this access. If the organization doesn't actively use this feature, keep it **Disabled**.
5. Select **Apply**.

#### Related links

* [Developer admin settings](https://learn.microsoft.com/fabric/admin/service-admin-portal-developer#allow-service-principals-to-create-and-use-profiles)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.9.1.11 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.11 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.11, nist-800-53-r5:AC-3 |
| PowerShell test | [Test-MtCisFabricServicePrincipalProfilesRestricted](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.11.ps1) |
| Services | Azure |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.9.1.11.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.11.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.9.1.11.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.11.md)