# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-POWER-011
title: Restrict guest invitations through Fabric sharing
finding:
  title: Users can invite new guests through Fabric item sharing
  description: Any user allowed to invite guests in Entra ID can bring a new external account into the tenant by sharing a Fabric or Power BI item.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [fabric, power-bi, guests, invitations, external-sharing]

applicability:
  requires:
    - "Power BI / Microsoft Fabric"

description: |
  The Fabric tenant setting **Users can invite guest users to collaborate through item sharing and
  permissions** (Export and sharing settings, formerly **Share content with external users**) is
  **Disabled**, or **Enabled** only for specific security groups of users approved to share
  analytics content externally.
rationale: |
  Sharing a report with an external email address creates a B2B guest account in the directory.
  If any user can do it, external accounts appear through Power BI without the review applied to
  other invitations, and receive access to business data immediately. Restricting the setting
  keeps guest creation in the hands of the people and processes that manage external
  collaboration.
impact: |
  Users outside the allowed groups can no longer invite new external users from Fabric. Existing
  guests keep their access and still appear in people pickers. The Entra guest invitation settings
  (Guest Inviter role, collaboration restrictions) still apply on top of this setting.

setting:
  location: Fabric admin portal > Tenant settings > Export and sharing settings > Users can invite guest users to collaborate through item sharing and permissions
  recommended_value: Disabled, or Enabled for specific security groups

audit:
  manual: |
    1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
    2. Open **Settings** > **Admin portal** > **Tenant settings** > **Export and sharing settings**
       and expand **Users can invite guest users to collaborate through item sharing and
       permissions**.
    3. Check that it is **Disabled**, or **Enabled** for **Specific security groups** only.
    4. Alternative, read only: in the response of `GET
       https://api.fabric.microsoft.com/v1/admin/tenantsettings`, read the entry
       `ExternalSharingV2`.
    5. Fail if the setting is enabled for the entire organization.

remediation:
  manual: |
    1. In **Tenant settings** > **Export and sharing settings** > **Users can invite guest users to
       collaborate through item sharing and permissions**, select **Disabled**, or **Enabled** with
       **Specific security groups**. Select **Apply**. Role: Fabric Administrator.
    2. API equivalent: `POST
       https://api.fabric.microsoft.com/v1/admin/tenantsettings/ExternalSharingV2/update` with the
       target state.
  rollback: |
    Set the setting back to its previous scope.

references:
  - title: Export and sharing tenant settings
    url: https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Power BI baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "9.1.2"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.POWERBI.3.1v1
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6
    relation: related
threats:
  - framework: mitre-attack
    id: T1199
  - framework: mitre-attack
    id: T1530
related_controls:
  - id: CB-M365-POWER-010
    type: related
  - id: CB-M365-POWER-012
    type: related
  - id: CB-M365-TENANT-011
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24