{
  "id": "CB-M365-POWER-012",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-012",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-012.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-012.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-012",
    "title": "Restrict guests from browsing Fabric content",
    "finding": {
      "title": "Guest users can browse Fabric content like internal users",
      "description": "Guests get the full navigation experience in Fabric and can discover workspaces, apps and items beyond the links shared with them."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "guests",
      "discovery"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Guest users can browse and access Fabric content** (Export and\nsharing settings) is **Disabled**, or **Enabled** only for specific security groups of guests who\nwork like members (for example long-term contractors). Other guests reach content only through\ndirect links and the permissions granted to them.\n",
    "rationale": "With the full browsing experience, a guest sees the left navigation, workspaces and apps\navailable to them and can find content shared with broad groups that was never meant for them.\nKeeping guests on direct links limits discovery and accidental exposure, while workspace roles\nand item permissions continue to work.\n",
    "impact": "Guests outside the allowed groups lose the navigation pane and must use the links they receive.\nTheir workspace roles and item permissions are kept.\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > Export and sharing settings > Guest users can browse and access Fabric content",
      "recommended_value": "Disabled, or Enabled for specific security groups"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **Export and sharing settings**\n   and expand **Guest users can browse and access Fabric content**.\n3. Check that it is **Disabled**, or **Enabled** for **Specific security groups** only.\n4. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,\n   read the entry `ElevatedGuestsTenant`.\n5. Fail if the setting is enabled for the entire organization.\n"
    },
    "remediation": {
      "manual": "1. In **Tenant settings** > **Export and sharing settings** > **Guest users can browse and\n   access Fabric content**, select **Disabled**, or **Enabled** with **Specific security\n   groups**. Select **Apply**. Role: Fabric Administrator.\n2. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/ElevatedGuestsTenant/update` with\n   the target state.\n",
      "rollback": "Set the setting back to its previous scope.\n"
    },
    "references": [
      {
        "title": "Export and sharing tenant settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1213"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-010",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-011",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-010",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}