Restrict Power BI links that grant access to everyone in the organization

Description

The Fabric tenant setting Allow shareable links to grant access to everyone in your organization (Export and sharing settings) is Disabled, or Enabled only for specific security groups. Other users share with Specific people or People with existing access.

Rationale

A People in your organization link works for anyone in the tenant who obtains it: forwarded emails, chat messages and pasted URLs spread it far beyond the intended audience, and nobody reviews who opened the report. Restricting organization-wide links forces explicit recipients for sensitive analytics, in line with need-to-know.

Impact

Users outside the allowed groups can no longer create organization-wide links; existing links keep working until removed. Content meant for everyone should be published through a Power BI app or shared with an all-employees group.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Export and sharing settings and expand Allow shareable links to grant access to everyone in your organization.
3. Check that it is Disabled, or Enabled for Specific security groups only.
4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry ShareLinkToEntireOrg; GET https://api.powerbi.com/v1.0/myorg/admin/widelySharedArtifacts/linksSharedToWholeOrganization lists items already shared this way.
5. Fail if the setting is enabled for the entire organization.

Remediation

1. In Tenant settings > Export and sharing settings > Allow shareable links to grant access to everyone in your organization, select Disabled, or Enabled with Specific security groups. Select Apply. Role: Fabric Administrator.
2. Review the items already shared with the whole organization and ask owners to replace the links with specific recipients or an app.
3. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/ShareLinkToEntireOrg/update with the target state.

Rollback

Set the setting back to its previous scope.

References

• Export and sharing tenant settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-013 Restrict Power BI Publish to web
• related CB-M365-POWER-015 Enable sensitivity labels for Fabric and Power BI content
• related CB-M365-POWER-017 Restrict who can turn on external sharing of semantic models

People and lifecycle