(L1) Restrict external guest invitations through Fabric
CIS.M365.9.1.2MediumMicrosoft FabricExport and sharing settingsPreview 3.0
Part of CIS · Microsoft Fabric · Export and sharing settings · All checks
Invoke-Maester -TestId CIS.M365.9.1.2Overview
Section titled “Overview”Guest invitations made through Fabric are disabled or limited to one or more security groups.
Restricting this invitation path reduces the chance that an unapproved user creates external access through content sharing. Other Microsoft Entra invitation controls remain separate.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Export and Sharing settings.
- Set Users can invite guest users to collaborate through item sharing and permissions to Disabled, or choose Enabled with Specific security groups selected and defined. If the organization doesn’t actively use this feature, keep it Disabled.
- Select Apply.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1136.003 Cloud Account |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.2, nist-800-53-r5:AC-2 |
| PowerShell test | Test-MtCisFabricGuestInvitationsRestricted |
| Services | Azure |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.9.1.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.2.md