CIS.M365.9.1.4 - (L1) Restrict public publishing of Fabric reports
Overview
Publish to web is disabled, or scoped to one or more security groups with new embed-code creation disabled.
The check verifies that the setting has at least one security group and that new embed-code creation is disabled. It does not inventory or revoke existing codes.
Remediation action
- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Export and Sharing settings.
- Set Publish to web to Disabled, or choose Enabled, set Choose how embed codes work to Only allow existing codes, and select and define Specific security groups. If the organization doesn't actively use this feature, keep it Disabled.
- Select Apply. Review existing embed codes separately and remove any that expose sensitive reports.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567 Exfiltration Over Web Service |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.4, nist-800-53-r5:AC-22 |
| PowerShell test | Test-MtCisFabricPublishToWebRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.4.md