CIS.M365.9.1.7 - (L1) Restrict organization-wide Fabric links
Overview
Organization-wide Fabric sharing links are disabled or limited to one or more security groups.
An organization-wide link can grant access to tenant users who were not individually granted access. Restricting who can create these links reduces accidental internal disclosure; it does not govern external guests.
Remediation action
- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Export and Sharing settings.
- Set Allow shareable links to grant access to everyone in your organization to Disabled, or choose Enabled with Specific security groups selected and defined. If the organization doesn't actively use this feature, keep it Disabled.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.7 |
| Severity | Low |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.7 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.7, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisFabricOrganizationLinksRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.7.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.7.md