Restrict guest invitations through Fabric sharing

Description

The Fabric tenant setting Users can invite guest users to collaborate through item sharing and permissions (Export and sharing settings, formerly Share content with external users) is Disabled, or Enabled only for specific security groups of users approved to share analytics content externally.

Rationale

Sharing a report with an external email address creates a B2B guest account in the directory. If any user can do it, external accounts appear through Power BI without the review applied to other invitations, and receive access to business data immediately. Restricting the setting keeps guest creation in the hands of the people and processes that manage external collaboration.

Impact

Users outside the allowed groups can no longer invite new external users from Fabric. Existing guests keep their access and still appear in people pickers. The Entra guest invitation settings (Guest Inviter role, collaboration restrictions) still apply on top of this setting.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Export and sharing settings and expand Users can invite guest users to collaborate through item sharing and permissions.
3. Check that it is Disabled, or Enabled for Specific security groups only.
4. Alternative, read only: in the response of GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry ExternalSharingV2.
5. Fail if the setting is enabled for the entire organization.

Remediation

1. In Tenant settings > Export and sharing settings > Users can invite guest users to collaborate through item sharing and permissions, select Disabled, or Enabled with Specific security groups. Select Apply. Role: Fabric Administrator.
2. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/ExternalSharingV2/update with the target state.

Rollback

Set the setting back to its previous scope.

References

• Export and sharing tenant settings Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power BI baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-010 Restrict guest user access to Microsoft Fabric
• related CB-M365-POWER-012 Restrict guests from browsing Fabric content
• related CB-M365-TENANT-011 Restrict guest invitations to administrators and Guest Inviters

People and lifecycle