Restrict guests from browsing Fabric content

Description

The Fabric tenant setting Guest users can browse and access Fabric content (Export and sharing settings) is Disabled, or Enabled only for specific security groups of guests who work like members (for example long-term contractors). Other guests reach content only through direct links and the permissions granted to them.

Rationale

With the full browsing experience, a guest sees the left navigation, workspaces and apps available to them and can find content shared with broad groups that was never meant for them. Keeping guests on direct links limits discovery and accidental exposure, while workspace roles and item permissions continue to work.

Impact

Guests outside the allowed groups lose the navigation pane and must use the links they receive. Their workspace roles and item permissions are kept.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Export and sharing settings and expand Guest users can browse and access Fabric content.
3. Check that it is Disabled, or Enabled for Specific security groups only.
4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry ElevatedGuestsTenant.
5. Fail if the setting is enabled for the entire organization.

Remediation

1. In Tenant settings > Export and sharing settings > Guest users can browse and access Fabric content, select Disabled, or Enabled with Specific security groups. Select Apply. Role: Fabric Administrator.
2. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/ElevatedGuestsTenant/update with the target state.

Rollback

Set the setting back to its previous scope.

References

• Export and sharing tenant settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-010 Restrict guest user access to Microsoft Fabric
• related CB-M365-POWER-011 Restrict guest invitations through Fabric sharing
• related CB-M365-TENANT-010 Restrict guest access to their own directory objects

People and lifecycle