# (L1) Enable sensitivity labels for Fabric content

Users can apply Microsoft Purview sensitivity labels to supported Fabric content.

Source: https://maester.dev/docs/tests/CIS.M365.9.1.6

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Microsoft Fabric · Information protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.9.1.6
```

## Overview

Users can apply Microsoft Purview sensitivity labels to supported Fabric content.

This setting enables label application in Fabric. It does not confirm that labels are published to users or that all sharing and export paths enforce label protection; the setting applies to supported exports.

#### Remediation action

1. Confirm that sensitivity labels are configured and published to the intended users, and that the required licensing prerequisites are met.
2. Sign in to the [Microsoft Fabric admin portal](https://app.powerbi.com/admin-portal) with a Fabric administrator account.
3. Select **Tenant settings**.
4. Scroll to **Information protection**.
5. Set **Allow users to apply sensitivity labels for content** to **Enabled**, or choose **Enabled** with **Specific security groups** selected and defined. Select **Apply**.

#### Related links

* [Information protection tenant settings](https://learn.microsoft.com/fabric/admin/service-admin-portal-information-protection)
* [Sensitivity labels in Power BI](https://learn.microsoft.com/power-bi/enterprise/service-security-sensitivity-label-overview)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.9.1.6 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Information protection |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.6 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.6, nist-800-53-r5:AC-16 |
| PowerShell test | [Test-MtCisFabricSensitivityLabelsEnabled](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.6.ps1) |
| Services | Azure |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.9.1.6.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.6.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.9.1.6.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.6.md)