Restrict guest user access to Microsoft Fabric

Description

The Fabric tenant setting Guest users can access Microsoft Fabric (Export and sharing settings) is Disabled, or Enabled only for specific security groups that contain the guests with an approved need. It is never enabled for the entire organization.

Rationale

Guests are invited for many reasons (a Teams channel, a SharePoint site) unrelated to business intelligence. If Fabric is open to all of them, any report, semantic model or lakehouse shared with a broad group becomes readable by external accounts whose lifecycle the organization does not control. Limiting Fabric to a named guest group keeps external access to analytics data deliberate.

Impact

Guests outside the allowed groups get an error when they open Fabric or Power BI, including items they were granted access to. Disabling the setting for the whole organization also prevents inviting guests through Fabric sharing. Create a security group for guests who legitimately use Power BI content (for example distributed reports) before restricting.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator (Fabric has no read-only role for tenant settings).
2. Open Settings (gear) > Admin portal > Tenant settings (also reachable from OneLake catalog > Govern > Configurations > Tenant settings).
3. Under Export and sharing settings, expand Guest users can access Microsoft Fabric.
4. Check that it is Disabled, or Enabled with Apply to set to Specific security groups listing only approved guest groups.
5. Alternative, read only: GET https://api.fabric.microsoft.com/v1/admin/tenantsettings (scope Tenant.Read.All, for example with Invoke-PowerBIRestMethod -Method Get -Url 'https://api.fabric.microsoft.com/v1/admin/tenantsettings' after Connect-PowerBIServiceAccount) and read the entry AllowGuestUserToAccessSharedContent: enabled must be false, or true with enabledSecurityGroups set.
6. Fail if the setting is enabled for the entire organization.

Remediation

1. Create a security group for the guests who need Fabric access and add them.
2. In Tenant settings > Export and sharing settings > Guest users can access Microsoft Fabric, select Disabled, or keep Enabled with Specific security groups and the guest group. Select Apply. Role: Fabric Administrator.
3. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/AllowGuestUserToAccessSharedContent/update with {"enabled": true, "enabledSecurityGroups": [{"graphId": "<group id>", "name": "<group name>"}]} or {"enabled": false}.

Rollback

Set the setting back to its previous scope.

References

• Export and sharing tenant settings Microsoft, vendor-doc, accessed 2026-10-24
• Tenants - List Tenant Settings (Fabric REST API) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power BI baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-011 Restrict guest invitations through Fabric sharing
• related CB-M365-POWER-012 Restrict guests from browsing Fabric content
• related CB-M365-TENANT-010 Restrict guest access to their own directory objects

People and lifecycle