cirsec Baselines
Esc
Microsoft 365 tenant · Power Platform, Fabric & Copilot Studio

Restrict Power BI Publish to web

When it fails: Any user can publish Power BI reports to the public web. Users can generate embed codes that make a report and its data readable by anyone on the internet, without authentication.

CB-M365-POWER-013highactivemanualprofile baseline

Description

The Fabric tenant setting Publish to web (Export and sharing settings) is Disabled, or Enabled only for a specific security group of users approved to publish public content, with Choose how embed codes work set to Allow only existing embed codes so that each new code needs an administrator. The Embed codes page of the admin portal is reviewed regularly and codes exposing internal data are deleted.

Rationale

A Publish to web embed code makes the report public: anyone with the URL, including search engines and archive services, can view it and the underlying data visible in its visuals, with no sign-in and no audit of who viewed it. Users often mistake it for a sharing feature. Disabling it, or limiting it to a reviewed group, prevents public data leaks.

Impact

Users outside the allowed group no longer see Publish to web. If the setting is disabled for the whole organization, existing public embed codes stop working; when restricted to groups, existing reports keep rendering. Review the Embed codes list before the change to identify legitimate public reports (for example open data pages).

Applies when

Requires: Power BI / Microsoft Fabric

Setting

LocationFabric admin portal > Tenant settings > Export and sharing settings > Publish to web
RecommendedDisabled, or Enabled for a specific security group with existing embed codes only

Audit

  1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
  2. Open Settings > Admin portal > Tenant settings > Export and sharing settings and expand Publish to web.
  3. Check that it is Disabled, or Enabled for Specific security groups only.
  4. Open Admin portal > Embed codes and review the active codes: each must correspond to content approved for public release.
  5. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry PublishToWeb; GET https://api.powerbi.com/v1.0/myorg/admin/widelySharedArtifacts/publishedToWeb lists published reports.
  6. Fail if the setting is enabled for the entire organization, or if an active embed code exposes non-public content.

Remediation

  1. In Admin portal > Embed codes, delete the codes exposing internal content.
  2. In Tenant settings > Export and sharing settings > Publish to web, select Disabled, or Enabled with Specific security groups and Allow only existing embed codes. Select Apply. Role: Fabric Administrator.
  3. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/PublishToWeb/update with the target state.

Rollback

Set the setting back to its previous scope. Deleted embed codes cannot be restored; the report owner must publish again.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AC-22related
NIST SP 800-53 Rev. 55.1.1SC-7(10)related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.POWERBI.1.1v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1530
  • related CB-M365-POWER-016 Restrict Power BI links that grant access to everyone in the organization

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr