CIS.M365.9.1.8 - (L1) Restrict external sharing of semantic models
Overview
External sharing of Fabric semantic models is disabled or limited to one or more security groups.
This setting governs the in-place sharing of semantic models with users in another tenant. If misused, it can provide a path for data to be shared outside the organization. It is separate from OneLake external data sharing.
Remediation action
- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Export and Sharing settings.
- Set Allow specific users to turn on external data sharing to Disabled, or choose Enabled with Specific security groups selected and defined. If the organization doesn't actively use this feature, keep it Disabled.
- Select Apply.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.8 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Export and sharing settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567 Exfiltration Over Web Service |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.8 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.8, nist-800-53-r5:AC-21 |
| PowerShell test | Test-MtCisFabricExternalSharingRestricted |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.8.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.8.md