Description
The Fabric tenant setting Interact with and share R and Python visuals (R and Python visuals settings) is Disabled. The setting applies to the whole organization and cannot be scoped to groups.
Rationale
R and Python visuals run arbitrary scripts on the service against the report's data. Scripts can embed libraries and logic that the organization does not review, and are a way to process or move data outside the usual Power BI controls. Where no reviewed use case exists, disabling the feature removes this unmanaged code path.
Impact
Reports that contain R or Python visuals show them as unavailable in the service. Data science teams that need these visuals should use Fabric notebooks in governed workspaces instead, or the organization must accept the exception for the whole tenant.
Applies when
Requires: Power BI / Microsoft Fabric
Setting
| Location | Fabric admin portal > Tenant settings > R and Python visuals settings > Interact with and share R and Python visuals |
| Default | Enabled |
| Recommended | Disabled |
Audit
- Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
- Open Settings > Admin portal > Tenant settings > R and Python visuals settings and expand Interact with and share R and Python visuals.
- Check that it is Disabled.
- Alternative, read only: in
GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entryRScriptVisual(enabledmust befalse). - Fail if the setting is enabled.
Remediation
- Identify reports using R or Python visuals with their owners.
- In Tenant settings > R and Python visuals settings > Interact with and share R and Python visuals, select Disabled and Apply. Role: Fabric Administrator.
- API equivalent:
POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/RScriptVisual/updatewith{"enabled": false}.
Rollback
Set the setting back to Enabled.
References
- R and Python visuals admin settings Microsoft, vendor-doc, accessed 2026-10-24
- CISA SCuBA Power BI baseline CISA, standard, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | related |
| NIST SP 800-53 Rev. 55.1.1 | SI-3 | related |
| CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0 | MS.POWERBI.6.1v1 | equivalent |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1059 |
| MITRE ATT&CK | T1567 |
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
