{
  "id": "CB-M365-POWER-015",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-015",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-015.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-015.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-015",
    "title": "Enable sensitivity labels for Fabric and Power BI content",
    "finding": {
      "title": "Users cannot apply sensitivity labels to Fabric content",
      "description": "Reports, semantic models and other Fabric items carry no classification, so label-based protection does not follow data exported to Office files or PDF."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "sensitivity-labels",
      "purview",
      "classification"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Allow users to apply sensitivity labels for content** (Information\nprotection) is **Enabled**, for the entire organization or for the groups that create and manage\ncontent. Microsoft Purview sensitivity labels are already published to these users. Related\nsettings are reviewed together: label inheritance from data sources and to downstream content,\nand **Restrict content with protected labels from being shared via link with everyone in your\norganization**.\n",
    "rationale": "Fabric holds aggregated business data that is often more sensitive than the source documents.\nLabels make that sensitivity visible to users, feed data loss prevention and auditing, and carry\nencryption to files exported to Excel, PowerPoint or PDF. Without the tenant setting, labels\npublished in Purview cannot be applied to Fabric items at all.\n",
    "impact": "Users see a sensitivity menu on Fabric items; mandatory labeling or default labels, if configured\nin Purview, apply to new content. Exported files may become encrypted and readable only by users\ncovered by the label. Applying labels requires a Power BI Pro or Premium Per User licence plus a\nPurview Information Protection licence for the user.\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > Information protection > Allow users to apply sensitivity labels for content",
      "default_value": "Disabled",
      "recommended_value": "Enabled"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **Information protection** and\n   expand **Allow users to apply sensitivity labels for content**.\n3. Check that it is **Enabled** (entire organization, or the groups that publish content).\n4. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,\n   read the entry `EimInformationProtectionEdit`.\n5. Fail if the setting is disabled.\n"
    },
    "remediation": {
      "manual": "1. Make sure sensitivity labels are published in Microsoft Purview to the users who will label\n   Fabric content.\n2. In **Tenant settings** > **Information protection** > **Allow users to apply sensitivity\n   labels for content**, select **Enabled**, choose the scope, and **Apply**. Role: Fabric\n   Administrator.\n3. Review the inheritance settings (**Apply sensitivity labels from data sources to their data in\n   Power BI**, **Automatically apply sensitivity labels to downstream content**) and enable\n   **Restrict content with protected labels from being shared via link with everyone in your\n   organization**.\n4. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/EimInformationProtectionEdit/update`\n   with `{\"enabled\": true}`.\n",
      "rollback": "Set the setting back to **Disabled**. Labels already applied stay on the items.\n"
    },
    "references": [
      {
        "title": "Information protection tenant settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-information-protection",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power BI baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERBI.7.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-16",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1530"
      },
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-016",
        "type": "related"
      },
      {
        "id": "CB-M365-DATA-005",
        "type": "requires"
      },
      {
        "id": "CB-M365-DATA-006",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}