# (L1) Block resource-key authentication for Fabric datasets

Resource-key authentication is blocked for Fabric streaming and push datasets.

Source: https://maester.dev/docs/tests/CIS.M365.9.1.9

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Microsoft Fabric · Developer settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.9.1.9
```

## Overview

Resource-key authentication is blocked for Fabric streaming and push datasets.

Resource keys are shared credentials rather than individual identities. Blocking them reduces reliance on reusable keys and improves attribution for API access.

#### Remediation action

1. Sign in to the [Microsoft Fabric admin portal](https://app.powerbi.com/admin-portal) with a Fabric administrator account.
2. Select **Tenant settings**.
3. Scroll to **Developer settings**.
4. Set **Block ResourceKey Authentication** to **Enabled**.
5. Select **Apply** and update any clients that still send data with resource keys to use identity-based authentication.

#### Related links

* [Developer admin settings](https://learn.microsoft.com/fabric/admin/service-admin-portal-developer#block-resourcekey-authentication)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.9.1.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.9, nist-800-53-r5:IA-5 |
| PowerShell test | [Test-MtCisFabricResourceKeyAuthenticationBlocked](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.9.ps1) |
| Services | Azure |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.9.1.9.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.9.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.9.1.9.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.9.1.9.md)