Block ResourceKey authentication in Power BI

Description

The Fabric tenant setting Block ResourceKey Authentication (Developer settings) is Enabled. Streaming and push datasets then only accept data through the API with Microsoft Entra authentication. The setting applies to the whole organization.

Rationale

A resource key is a static secret embedded in a URL. It is easily copied into scripts, IoT devices or chat messages, never expires on its own, and its use is not tied to an identity. Whoever obtains it can inject false or malicious data into dashboards that people rely on. Requiring Entra authentication removes these anonymous write paths.

Impact

Integrations that push data to streaming or push datasets with a resource key (often IoT or Power Automate flows using the key URL) stop working. Move them to authenticated API calls with a service principal or user identity before enabling the block.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Developer settings and expand Block ResourceKey Authentication.
3. Check that it is Enabled.
4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry BlockResourceKeyAuthentication (enabled must be true).
5. Fail if the block is disabled.

Remediation

1. Identify streaming and push datasets fed with resource keys and move their sources to authenticated API calls.
2. In Tenant settings > Developer settings > Block ResourceKey Authentication, select Enabled and Apply. Role: Fabric Administrator.
3. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/BlockResourceKeyAuthentication/update with {"enabled": true}.

Rollback

Set the setting back to Disabled.

References

• Developer admin settings Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power BI baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle