CIS.M365.9.1.5 - (L2) Disable R and Python visuals in Fabric

Contributed by jeremy finneyAll contributors →

Overview

R and Python visuals are disabled for the Fabric tenant.

These visuals execute scripts when reports render. Turning off the tenant setting reduces the code-execution surface in reports; Microsoft does not provide a security-group scope for this setting.

Remediation action

1. Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
2. Select Tenant settings.
3. Scroll to R and Python visuals settings.
4. Set Interact with and share R and Python visuals to Disabled. This setting applies to the entire organization and can't be limited to groups.
5. Select Apply.
6. Identify reports that depend on these visuals and move them to an approved alternative.

Related links

• R and Python visuals admin settings
• CIS Microsoft 365 Foundations Benchmark v7.0.0

Test Metadata

Field	Value
Test ID	CIS.M365.9.1.5
Severity	Medium
Suite	CIS
Product	Microsoft Fabric
Feature	Tenant settings
Area	Infrastructure hardening
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1059 Command and Scripting Interpreter
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.5
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:9.1.5, nist-800-53-r5:CM-7
PowerShell test	Test-MtCisFabricScriptVisualsDisabled
Services	Azure

Source

• Test: tests/cis/Test.CIS.M365.9.1.5.ps1
• Documentation: tests/cis/Test.CIS.M365.9.1.5.md