(L1) Block resource-key authentication for Fabric datasets
CIS.M365.9.1.9MediumMicrosoft FabricDeveloper settingsPreview 3.0
Part of CIS · Microsoft Fabric · Developer settings · All checks
Invoke-Maester -TestId CIS.M365.9.1.9Overview
Section titled “Overview”Resource-key authentication is blocked for Fabric streaming and push datasets.
Resource keys are shared credentials rather than individual identities. Blocking them reduces reliance on reusable keys and improves attribution for API access.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Developer settings.
- Set Block ResourceKey Authentication to Enabled.
- Select Apply and update any clients that still send data with resource keys to use identity-based authentication.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.9, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCisFabricResourceKeyAuthenticationBlocked |
| Services | Azure |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.9.1.9.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.9.md