CIS.M365.9.1.1 - (L1) Restrict guest access to Fabric
Overview
Guest access to Microsoft Fabric is disabled or limited to one or more security groups.
Limiting which guest accounts can enter Fabric reduces exposure from external identities. Item and workspace permissions still determine which content a guest can access.
Remediation action
- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Export and Sharing settings.
- Set Guest users can access Microsoft Fabric to Disabled, or choose Enabled with Specific security groups selected and defined. If the organization doesn't actively use this feature, keep it Disabled.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.1, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricGuestAccessRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.1.md