(L1) Restrict guest browsing of Fabric content
CIS.M365.9.1.3LowMicrosoft FabricExport and sharing settingsPreview 3.0
Part of CIS · Microsoft Fabric · Export and sharing settings · All checks
Invoke-Maester -TestId CIS.M365.9.1.3Overview
Section titled “Overview”Guest browsing of Fabric content is disabled or limited to one or more security groups.
Scoping this setting limits the Fabric content that an external identity can discover through browsing. It does not revoke workspace roles or direct item permissions already granted to guests.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Export and Sharing settings.
- Set Guest users can browse and access Fabric content to Disabled, or choose Enabled with Specific security groups selected and defined. If the organization doesn’t actively use this feature, keep it Disabled.
- Select Apply. Review existing guest workspace and item permissions separately.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.3 |
| Severity | Low |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1213 Data from Information Repositories |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.3, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricGuestBrowsingRestricted |
| Services | Azure |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.9.1.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.3.md