# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-POWER-012
title: Restrict guests from browsing Fabric content
finding:
  title: Guest users can browse Fabric content like internal users
  description: Guests get the full navigation experience in Fabric and can discover workspaces, apps and items beyond the links shared with them.
status: active
profiles: [baseline]
risk:
  severity: low
assessment: manual
tags: [fabric, power-bi, guests, discovery]

applicability:
  requires:
    - "Power BI / Microsoft Fabric"

description: |
  The Fabric tenant setting **Guest users can browse and access Fabric content** (Export and
  sharing settings) is **Disabled**, or **Enabled** only for specific security groups of guests who
  work like members (for example long-term contractors). Other guests reach content only through
  direct links and the permissions granted to them.
rationale: |
  With the full browsing experience, a guest sees the left navigation, workspaces and apps
  available to them and can find content shared with broad groups that was never meant for them.
  Keeping guests on direct links limits discovery and accidental exposure, while workspace roles
  and item permissions continue to work.
impact: |
  Guests outside the allowed groups lose the navigation pane and must use the links they receive.
  Their workspace roles and item permissions are kept.

setting:
  location: Fabric admin portal > Tenant settings > Export and sharing settings > Guest users can browse and access Fabric content
  recommended_value: Disabled, or Enabled for specific security groups

audit:
  manual: |
    1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
    2. Open **Settings** > **Admin portal** > **Tenant settings** > **Export and sharing settings**
       and expand **Guest users can browse and access Fabric content**.
    3. Check that it is **Disabled**, or **Enabled** for **Specific security groups** only.
    4. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,
       read the entry `ElevatedGuestsTenant`.
    5. Fail if the setting is enabled for the entire organization.

remediation:
  manual: |
    1. In **Tenant settings** > **Export and sharing settings** > **Guest users can browse and
       access Fabric content**, select **Disabled**, or **Enabled** with **Specific security
       groups**. Select **Apply**. Role: Fabric Administrator.
    2. API equivalent: `POST
       https://api.fabric.microsoft.com/v1/admin/tenantsettings/ElevatedGuestsTenant/update` with
       the target state.
  rollback: |
    Set the setting back to its previous scope.

references:
  - title: Export and sharing tenant settings
    url: https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "9.1.3"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-3
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6
    relation: related
threats:
  - framework: mitre-attack
    id: T1213
related_controls:
  - id: CB-M365-POWER-010
    type: related
  - id: CB-M365-POWER-011
    type: related
  - id: CB-M365-TENANT-010
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24