{
  "id": "CB-M365-POWER-014",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-014",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-014.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-014.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-014",
    "title": "Disable R and Python visuals in Power BI",
    "finding": {
      "title": "Users can interact with and share R and Python visuals",
      "description": "Reports can run R or Python scripts written by any author, a code path the organization does not review."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "r-python",
      "scripts",
      "code-execution"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Interact with and share R and Python visuals** (R and Python visuals\nsettings) is **Disabled**. The setting applies to the whole organization and cannot be scoped to\ngroups.\n",
    "rationale": "R and Python visuals run arbitrary scripts on the service against the report's data. Scripts can\nembed libraries and logic that the organization does not review, and are a way to process or move\ndata outside the usual Power BI controls. Where no reviewed use case exists, disabling the feature\nremoves this unmanaged code path.\n",
    "impact": "Reports that contain R or Python visuals show them as unavailable in the service. Data science\nteams that need these visuals should use Fabric notebooks in governed workspaces instead, or the\norganization must accept the exception for the whole tenant.\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > R and Python visuals settings > Interact with and share R and Python visuals",
      "default_value": "Enabled",
      "recommended_value": "Disabled"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **R and Python visuals\n   settings** and expand **Interact with and share R and Python visuals**.\n3. Check that it is **Disabled**.\n4. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,\n   read the entry `RScriptVisual` (`enabled` must be `false`).\n5. Fail if the setting is enabled.\n"
    },
    "remediation": {
      "manual": "1. Identify reports using R or Python visuals with their owners.\n2. In **Tenant settings** > **R and Python visuals settings** > **Interact with and share R and\n   Python visuals**, select **Disabled** and **Apply**. Role: Fabric Administrator.\n3. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/RScriptVisual/update` with\n   `{\"enabled\": false}`.\n",
      "rollback": "Set the setting back to **Enabled**.\n"
    },
    "references": [
      {
        "title": "R and Python visuals admin settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-r-python-visuals",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power BI baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERBI.6.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1059"
      },
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}