# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-POWER-013
title: Restrict Power BI Publish to web
finding:
  title: Any user can publish Power BI reports to the public web
  description: Users can generate embed codes that make a report and its data readable by anyone on the internet, without authentication.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [fabric, power-bi, publish-to-web, public-exposure, data-leak]

applicability:
  requires:
    - "Power BI / Microsoft Fabric"

description: |
  The Fabric tenant setting **Publish to web** (Export and sharing settings) is **Disabled**, or
  **Enabled** only for a specific security group of users approved to publish public content, with
  **Choose how embed codes work** set to **Allow only existing embed codes** so that each new code
  needs an administrator. The **Embed codes** page of the admin portal is reviewed regularly and
  codes exposing internal data are deleted.
rationale: |
  A Publish to web embed code makes the report public: anyone with the URL, including search
  engines and archive services, can view it and the underlying data visible in its visuals, with no
  sign-in and no audit of who viewed it. Users often mistake it for a sharing feature. Disabling it,
  or limiting it to a reviewed group, prevents public data leaks.
impact: |
  Users outside the allowed group no longer see **Publish to web**. If the setting is disabled for
  the whole organization, existing public embed codes stop working; when restricted to groups,
  existing reports keep rendering. Review the **Embed codes** list before the change to identify
  legitimate public reports (for example open data pages).

setting:
  location: Fabric admin portal > Tenant settings > Export and sharing settings > Publish to web
  recommended_value: Disabled, or Enabled for a specific security group with existing embed codes only

audit:
  manual: |
    1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
    2. Open **Settings** > **Admin portal** > **Tenant settings** > **Export and sharing settings**
       and expand **Publish to web**.
    3. Check that it is **Disabled**, or **Enabled** for **Specific security groups** only.
    4. Open **Admin portal** > **Embed codes** and review the active codes: each must correspond to
       content approved for public release.
    5. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,
       read the entry `PublishToWeb`; `GET https://api.powerbi.com/v1.0/myorg/admin/widelySharedArtifacts/publishedToWeb`
       lists published reports.
    6. Fail if the setting is enabled for the entire organization, or if an active embed code
       exposes non-public content.

remediation:
  manual: |
    1. In **Admin portal** > **Embed codes**, delete the codes exposing internal content.
    2. In **Tenant settings** > **Export and sharing settings** > **Publish to web**, select
       **Disabled**, or **Enabled** with **Specific security groups** and **Allow only existing
       embed codes**. Select **Apply**. Role: Fabric Administrator.
    3. API equivalent: `POST
       https://api.fabric.microsoft.com/v1/admin/tenantsettings/PublishToWeb/update` with the target
       state.
  rollback: |
    Set the setting back to its previous scope. Deleted embed codes cannot be restored; the report
    owner must publish again.

references:
  - title: Export and sharing tenant settings
    url: https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Power BI baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "9.1.4"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.POWERBI.1.1v1
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-22
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SC-7(10)
    relation: related
threats:
  - framework: mitre-attack
    id: T1530
related_controls:
  - id: CB-M365-POWER-016
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24