CIS.M365.9.1.10 - (L1) Restrict service principal access to Fabric public APIs
Overview
Service-principal access to Fabric public APIs is disabled or limited to one or more security groups.
This setting governs APIs protected by the Fabric permission model. Restricting the allowed service principals reduces the impact of a compromised application identity.
Remediation action
- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Developer settings.
- Set Service principals can call Fabric public APIs to Disabled, or choose Enabled with Specific security groups selected and defined for the applications that need this access. If the organization doesn't actively use this feature, keep it Disabled.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.10 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.10 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.10, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricPublicApiAccessRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.10.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.10.md