CIS.M365.9.1.9 - (L1) Block resource-key authentication for Fabric datasets
Overview
Resource-key authentication is blocked for Fabric streaming and push datasets.
Resource keys are shared credentials rather than individual identities. Blocking them reduces reliance on reusable keys and improves attribution for API access.
Remediation action
- Sign in to the Microsoft Fabric admin portal with a Fabric administrator account.
- Select Tenant settings.
- Scroll to Developer settings.
- Set Block ResourceKey Authentication to Enabled.
- Select Apply and update any clients that still send data with resource keys to use identity-based authentication.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.9.1.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft Fabric |
| Feature | Developer settings |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 9.1.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:9.1.9, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCisFabricResourceKeyAuthenticationBlocked |
| Services | Azure |
Source
- Test:
tests/cis/Test.CIS.M365.9.1.9.ps1 - Documentation:
tests/cis/Test.CIS.M365.9.1.9.md