{
  "id": "CB-M365-POWER-013",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-013",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-013.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-013.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-013",
    "title": "Restrict Power BI Publish to web",
    "finding": {
      "title": "Any user can publish Power BI reports to the public web",
      "description": "Users can generate embed codes that make a report and its data readable by anyone on the internet, without authentication."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "publish-to-web",
      "public-exposure",
      "data-leak"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Publish to web** (Export and sharing settings) is **Disabled**, or\n**Enabled** only for a specific security group of users approved to publish public content, with\n**Choose how embed codes work** set to **Allow only existing embed codes** so that each new code\nneeds an administrator. The **Embed codes** page of the admin portal is reviewed regularly and\ncodes exposing internal data are deleted.\n",
    "rationale": "A Publish to web embed code makes the report public: anyone with the URL, including search\nengines and archive services, can view it and the underlying data visible in its visuals, with no\nsign-in and no audit of who viewed it. Users often mistake it for a sharing feature. Disabling it,\nor limiting it to a reviewed group, prevents public data leaks.\n",
    "impact": "Users outside the allowed group no longer see **Publish to web**. If the setting is disabled for\nthe whole organization, existing public embed codes stop working; when restricted to groups,\nexisting reports keep rendering. Review the **Embed codes** list before the change to identify\nlegitimate public reports (for example open data pages).\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > Export and sharing settings > Publish to web",
      "recommended_value": "Disabled, or Enabled for a specific security group with existing embed codes only"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **Export and sharing settings**\n   and expand **Publish to web**.\n3. Check that it is **Disabled**, or **Enabled** for **Specific security groups** only.\n4. Open **Admin portal** > **Embed codes** and review the active codes: each must correspond to\n   content approved for public release.\n5. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,\n   read the entry `PublishToWeb`; `GET https://api.powerbi.com/v1.0/myorg/admin/widelySharedArtifacts/publishedToWeb`\n   lists published reports.\n6. Fail if the setting is enabled for the entire organization, or if an active embed code\n   exposes non-public content.\n"
    },
    "remediation": {
      "manual": "1. In **Admin portal** > **Embed codes**, delete the codes exposing internal content.\n2. In **Tenant settings** > **Export and sharing settings** > **Publish to web**, select\n   **Disabled**, or **Enabled** with **Specific security groups** and **Allow only existing\n   embed codes**. Select **Apply**. Role: Fabric Administrator.\n3. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/PublishToWeb/update` with the target\n   state.\n",
      "rollback": "Set the setting back to its previous scope. Deleted embed codes cannot be restored; the report\nowner must publish again.\n"
    },
    "references": [
      {
        "title": "Export and sharing tenant settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power BI baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERBI.1.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-22",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7(10)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1530"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-016",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}