Restrict who can turn on external sharing of semantic models

Description

The Fabric tenant setting Allow specific users to turn on external data sharing (Export and sharing settings) is Disabled, or Enabled only for specific security groups of owners approved to share semantic models with other organizations.

The related OneLake settings External data sharing and Users can accept external data shares follow the same rule: disabled, or limited to approved groups.

Rationale

In-place sharing lets B2B guests discover and use a semantic model from their home tenant, with their own reports and capacity. The data then flows into another organization's environment, outside this tenant's audit and lifecycle. Limiting who can turn it on keeps cross-tenant data sharing to reviewed cases.

Impact

Owners outside the allowed groups can no longer enable external sharing on their semantic models. Existing external shares should be reviewed with their owners.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Export and sharing settings and expand Allow specific users to turn on external data sharing. Also check External data sharing and Users can accept external data shares.
3. Check that each is Disabled, or Enabled for Specific security groups only.
4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry EnableDatasetInPlaceSharing.
5. Fail if any of these settings is enabled for the entire organization.

Remediation

1. In Tenant settings > Export and sharing settings > Allow specific users to turn on external data sharing, select Disabled, or Enabled with Specific security groups. Select Apply. Role: Fabric Administrator.
2. Apply the same scope to External data sharing and Users can accept external data shares.
3. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/EnableDatasetInPlaceSharing/update with the target state.

Rollback

Set the settings back to their previous scope.

References

• Export and sharing tenant settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-016 Restrict Power BI links that grant access to everyone in the organization

People and lifecycle