(L1) Restrict public publishing of Fabric reports
CIS.M365.9.1.4MediumMicrosoft FabricExport and sharing settingsPreview 3.0
Part of CIS · Microsoft Fabric · Export and sharing settings · All checks
Invoke-Maester -TestId CIS.M365.9.1.4Overview
Section titled “Overview”Publish to web is disabled, or scoped to one or more security groups with new embed-code creation disabled.
The check verifies that the setting has at least one security group and that new embed-code creation is disabled. It does not inventory or revoke existing codes.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Export and Sharing settings.
- Set Publish to web to Disabled, or choose Enabled, set Choose how embed codes work to Only allow existing codes, and select and define Specific security groups. If the organization doesn’t actively use this feature, keep it Disabled.
- Select Apply. Review existing embed codes separately and remove any that expose sensitive reports.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567 Exfiltration Over Web Service |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.4, nist-800-53-r5:AC-22 |
| PowerShell test | Test-MtCisFabricPublishToWebRestricted |
| Services | Azure |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.9.1.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.4.md