# (L1) Restrict external guest invitations through Fabric

Guest invitations made through Fabric are disabled or limited to one or more security groups.

Source: https://maester.dev/docs/tests/CIS.M365.9.1.2

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Microsoft Fabric · Export and sharing settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.9.1.2
```

## Overview

Guest invitations made through Fabric are disabled or limited to one or more security groups.

Restricting this invitation path reduces the chance that an unapproved user creates external access through content sharing. Other Microsoft Entra invitation controls remain separate.

#### Remediation action

1. Sign in to the [Microsoft Fabric admin portal](https://app.powerbi.com/admin-portal) with a Fabric administrator account.
2. Select **Tenant settings**.
3. Scroll to **Export and Sharing settings**.
4. Set **Users can invite guest users to collaborate through item sharing and permissions** to **Disabled**, or choose **Enabled** with **Specific security groups** selected and defined. If the organization doesn't actively use this feature, keep it **Disabled**.
5. Select **Apply**.

#### Related links

* [Export and sharing tenant settings](https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.9.1.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1136.003 Cloud Account |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.2, nist-800-53-r5:AC-2 |
| PowerShell test | [Test-MtCisFabricGuestInvitationsRestricted](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.2.ps1) |
| Services | Azure |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.9.1.2.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.2.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.9.1.2.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.2.md)