Microsoft Fabric and Power BI Hardening: What CIS Benchmark Section 9 Checks (12 Controls)

The CIS Microsoft 365 Foundations Benchmark v7.0.0 defines 160 controls across 9 sections. Section 9 — Microsoft Fabric, the platform that now includes Power BI — contains 12 of them, and it is the section most often skipped entirely. Not because it is difficult, but because the people who run the tenant and the people who run the analytics platform are usually not the same team.

That gap is the actual risk. Every other section governs a surface a Microsoft 365 administrator already thinks about: mailboxes, sites, identities, meetings. Section 9 governs a platform where a business analyst can publish a report to the public internet from a menu, and where the administrator who would have objected never sees it happen.

For an overview of all 9 sections and their control counts, see the CIS Microsoft 365 Foundations Benchmark guide.

How Section 9 is structured

Unlike the other large sections, Section 9 has no internal split. All 12 controls sit under a single subsection, 9.1, and every one of them is a tenant setting in the Microsoft Fabric admin portal.

By profile, Section 9 is 11 Level 1 and 1 Level 2 control, the highest Level 1 share of any section with more than five controls. By assessment status, all 12 are automated; Section 9 contains no manual control at all. All 12 fall under an E3 profile, so nothing here depends on E5 licensing.

The near-total Level 1 rating is worth pausing on. Level 1 in the benchmark means minimal impact on functionality — settings you can apply without breaking a workflow someone depended on. Eleven of twelve Section 9 controls being Level 1 says something specific about this section: it is not a set of trade-offs to negotiate with the business. It is mostly permissive defaults that nobody ever chose.

Because everything lives in one console, Section 9 is the cheapest section in the benchmark to remediate — and, for exactly the same reason, the easiest to leave untouched for years.

Guest and external access — 4 controls

Four of the twelve controls govern who outside the organisation can reach analytics content, and who is allowed to let them in.

• 9.1.1 — Ensure guest user access is restricted (E3 Level 1, Automated). Guest access to Fabric is a separate decision from whatever you configured for guests in Section 5. The identity is governed centrally in Microsoft Entra; what that identity can do once it is inside the analytics platform is governed here.
• 9.1.2 — Ensure external user invitations are restricted (E3 Level 1, Automated). This one governs who can issue the invitation in the first place. When it is left open, a workspace member can bring an outside party into the tenant without an administrator being involved at any point in the process.
• 9.1.3 — Ensure guest access to content is restricted (E3 Level 1, Automated). Distinct from 9.1.1: this is about what a guest who is already inside can reach. The two together are the difference between guests existing and guests browsing.
• 9.1.8 — Ensure enabling of external data sharing is restricted (E3 Level 1, Automated). External data sharing lets users share datasets outside the organisation. The distinction that matters is that this shares the data, not a view of it — the recipient receives something they can build on, retain, and re-share, and it stops being covered by your access reviews the moment it leaves.

How to check: Microsoft Fabric admin portal → Tenant settings. All four are tenant-level toggles, each with an optional security group scope.

Publishing and link sharing — 2 controls

• 9.1.4 — Ensure ‘Publish to web’ is restricted (E3 Level 1, Automated). This is the most consequential single setting in Section 9. Publish to web generates a public URL for a report — no authentication, no tenant boundary, reachable by anyone who has the address. It is a feature built for genuinely public data, and it sits in the same menu as everything else. When it is unrestricted, one person misjudging one report becomes a public disclosure with no access log to review afterwards, because there was no access control to log against.
• 9.1.7 — Ensure shareable links are restricted (E3 Level 1, Automated). The internal equivalent: links that grant access to anyone in the organisation rather than to named recipients. This is the same failure mode as the permissive link defaults in Section 7, applied to reports instead of files — the link outlives the reason it was created, and it grants access to whoever ends up holding it.

How to check: Microsoft Fabric admin portal → Tenant settings, under the export and sharing group. If you only have time for one Section 9 control today, check 9.1.4.

Code execution, labelling, and authentication — 3 controls

• 9.1.5 — Ensure ‘Interact with and share R and Python’ visuals is ‘Disabled’ (E3 Level 2, Automated). The only Level 2 control in Section 9, and the only one where the benchmark concedes a real cost. R and Python visuals execute code supplied inside a report. That is a legitimate and widely used capability for data science teams, which is precisely why disabling it is rated Level 2 rather than Level 1. If your organisation genuinely uses these visuals, this is a control to document as a deliberate exception — not one to force through and then explain later.
• 9.1.6 — Ensure ‘Allow users to apply sensitivity labels for content’ is ‘Enabled’ (E3 Level 1, Automated). The one control in Section 9 that turns something on rather than off. Sensitivity labels are how analytics content inherits the Microsoft Purview Information Protection scheme that Section 3 of the benchmark covers. Without this enabled, a report is classified by nothing, and the labelling policy you built elsewhere simply stops at the edge of the analytics platform.
• 9.1.9 — Ensure ‘Block ResourceKey Authentication’ is ‘Enabled’ (E3 Level 1, Automated). ResourceKey authentication permits access on the basis of a key rather than an organisational identity. Anything that authenticates on possession of a string rather than possession of an account sits outside every identity control in Section 5 — no Conditional Access evaluation, no MFA, and no sign-in record attributable to a person. Blocking it closes a path that bypasses identity entirely.

Service principals — 3 controls

Three of the twelve controls govern non-human identities. That is a large share for a 12-control section, and it reflects how much of a mature Fabric deployment actually runs on automation rather than on people clicking things.

• 9.1.10 — Ensure access to APIs by service principals is restricted (E3 Level 1, Automated)
• 9.1.11 — Ensure service principals cannot create and use profiles (E3 Level 1, Automated)
• 9.1.12 — Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted (E3 Level 1, Automated)

All three are Level 1 because restricting service principals does not mean blocking them. In each case the recommended state is a specific allowed security group rather than a global off switch, so existing automation keeps working — it just has to be registered somewhere a human can review it.

What makes these worth the attention is that a service principal has nobody to notice it behaving oddly. It does not get phished, it does not report a suspicious prompt, and it does not stop working when the person who created it leaves the company. Unrestricted API access by service principals means the analytics platform can be read programmatically by whatever holds a valid credential, at machine speed, without producing a sign-in that looks unusual to anyone.

How to check: Microsoft Fabric admin portal → Tenant settings, under the developer and admin API groups. For each of the three, confirm the allowed security group contains only automation you can still account for.

Why Section 9 gets missed

Section 9 does not drift the way Section 8 does. Teams settings get actively reversed under time pressure when a meeting fails or a partner cannot join. Fabric settings, by contrast, are usually never set at all.

Three things make that likely. The Microsoft Fabric admin portal is a separate console from the Microsoft 365 admin center, so it is not on the path of a routine tenant review. The Fabric administrator role is frequently delegated to the analytics team rather than held by security. And these controls have no visible failure mode — an unrestricted Publish to web setting produces no alert, no ticket, and no user complaint. It produces a public URL that works.

The practical consequence is that Section 9 is the section most likely to be discovered during an audit rather than before one. It is also the section where remediation is fastest: 12 tenant settings, all 12 automated to assess, all in one portal, 11 of them Level 1.

How ConfigCobra assesses Section 9

ConfigCobra evaluates the Section 9 controls as part of a full CIS Microsoft 365 Foundations Benchmark v7.0.0 assessment. The scan connects to your tenant using read-only Microsoft Graph permissions — no agents, no admin password sharing — and returns results for all 160 controls across all 9 sections in 20–25 minutes.

Each finding comes back with its status against the recommended state, the evidence behind it, the severity tagged from the benchmark itself, and a copy-paste remediation script or admin portal steps. Results export to a CIS-certified PDF report with a timestamped tenant snapshot — which is the artefact that matters most for this section, because otherwise ‘we checked the Fabric tenant settings’ is a claim with nothing behind it.

Because Section 9 is typically owned by a different team than the rest of the tenant, the read-only auditor seat is the practical way to close the loop: the analytics owner can see the findings for their own platform without being granted anything else.

Run it against your own tenant

Start a free trial, 14 days with full access, to find out whether Publish to web is currently unrestricted in your own tenant.

The rest of the series

• Section 1 — Microsoft 365 admin center (15 controls)
• Section 2 — Microsoft Defender for Office 365 (21 controls)
• Section 5 — Microsoft Entra (Identity) (63 controls)
• Section 6 — Exchange Online (13 controls)
• Section 7 — SharePoint Online and OneDrive (12 controls)
• Section 8 — Microsoft Teams (17 controls)

For the full benchmark overview including every section control count, see the CIS Microsoft 365 Foundations Benchmark page.