{
  "id": "CB-M365-POWER-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-011.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-011",
    "title": "Restrict guest invitations through Fabric sharing",
    "finding": {
      "title": "Users can invite new guests through Fabric item sharing",
      "description": "Any user allowed to invite guests in Entra ID can bring a new external account into the tenant by sharing a Fabric or Power BI item."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "guests",
      "invitations",
      "external-sharing"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Users can invite guest users to collaborate through item sharing and\npermissions** (Export and sharing settings, formerly **Share content with external users**) is\n**Disabled**, or **Enabled** only for specific security groups of users approved to share\nanalytics content externally.\n",
    "rationale": "Sharing a report with an external email address creates a B2B guest account in the directory.\nIf any user can do it, external accounts appear through Power BI without the review applied to\nother invitations, and receive access to business data immediately. Restricting the setting\nkeeps guest creation in the hands of the people and processes that manage external\ncollaboration.\n",
    "impact": "Users outside the allowed groups can no longer invite new external users from Fabric. Existing\nguests keep their access and still appear in people pickers. The Entra guest invitation settings\n(Guest Inviter role, collaboration restrictions) still apply on top of this setting.\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > Export and sharing settings > Users can invite guest users to collaborate through item sharing and permissions",
      "recommended_value": "Disabled, or Enabled for specific security groups"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **Export and sharing settings**\n   and expand **Users can invite guest users to collaborate through item sharing and\n   permissions**.\n3. Check that it is **Disabled**, or **Enabled** for **Specific security groups** only.\n4. Alternative, read only: in the response of `GET\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings`, read the entry\n   `ExternalSharingV2`.\n5. Fail if the setting is enabled for the entire organization.\n"
    },
    "remediation": {
      "manual": "1. In **Tenant settings** > **Export and sharing settings** > **Users can invite guest users to\n   collaborate through item sharing and permissions**, select **Disabled**, or **Enabled** with\n   **Specific security groups**. Select **Apply**. Role: Fabric Administrator.\n2. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/ExternalSharingV2/update` with the\n   target state.\n",
      "rollback": "Set the setting back to its previous scope.\n"
    },
    "references": [
      {
        "title": "Export and sharing tenant settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power BI baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERBI.3.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1199"
      },
      {
        "framework": "mitre-attack",
        "id": "T1530"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-010",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-012",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-011",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}