{
  "id": "CB-M365-POWER-017",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-017",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-017.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-017.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-017",
    "title": "Restrict who can turn on external sharing of semantic models",
    "finding": {
      "title": "Any user can share semantic models in place with other tenants",
      "description": "Semantic model owners can let guests from other tenants connect to and build on the data from their own tenant."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "external-sharing",
      "semantic-models",
      "cross-tenant"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Allow specific users to turn on external data sharing** (Export and\nsharing settings) is **Disabled**, or **Enabled** only for specific security groups of owners\napproved to share semantic models with other organizations.\n\nThe related OneLake settings **External data sharing** and **Users can accept external data\nshares** follow the same rule: disabled, or limited to approved groups.\n",
    "rationale": "In-place sharing lets B2B guests discover and use a semantic model from their home tenant, with\ntheir own reports and capacity. The data then flows into another organization's environment,\noutside this tenant's audit and lifecycle. Limiting who can turn it on keeps cross-tenant data\nsharing to reviewed cases.\n",
    "impact": "Owners outside the allowed groups can no longer enable external sharing on their semantic models.\nExisting external shares should be reviewed with their owners.\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > Export and sharing settings > Allow specific users to turn on external data sharing",
      "recommended_value": "Disabled, or Enabled for specific security groups"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **Export and sharing settings**\n   and expand **Allow specific users to turn on external data sharing**. Also check **External\n   data sharing** and **Users can accept external data shares**.\n3. Check that each is **Disabled**, or **Enabled** for **Specific security groups** only.\n4. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,\n   read the entry `EnableDatasetInPlaceSharing`.\n5. Fail if any of these settings is enabled for the entire organization.\n"
    },
    "remediation": {
      "manual": "1. In **Tenant settings** > **Export and sharing settings** > **Allow specific users to turn on\n   external data sharing**, select **Disabled**, or **Enabled** with **Specific security\n   groups**. Select **Apply**. Role: Fabric Administrator.\n2. Apply the same scope to **External data sharing** and **Users can accept external data\n   shares**.\n3. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/EnableDatasetInPlaceSharing/update`\n   with the target state.\n",
      "rollback": "Set the settings back to their previous scope.\n"
    },
    "references": [
      {
        "title": "Export and sharing tenant settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-export-sharing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1537"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-016",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}