{
  "id": "CB-M365-POWER-018",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-018",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-018.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-018.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-018",
    "title": "Block ResourceKey authentication in Power BI",
    "finding": {
      "title": "Power BI accepts ResourceKey authentication for streaming and push datasets",
      "description": "Anyone holding a dataset's resource key URL can push data into it without a Microsoft Entra token."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "api",
      "authentication",
      "secrets"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Block ResourceKey Authentication** (Developer settings) is\n**Enabled**. Streaming and push datasets then only accept data through the API with Microsoft\nEntra authentication. The setting applies to the whole organization.\n",
    "rationale": "A resource key is a static secret embedded in a URL. It is easily copied into scripts, IoT\ndevices or chat messages, never expires on its own, and its use is not tied to an identity.\nWhoever obtains it can inject false or malicious data into dashboards that people rely on.\nRequiring Entra authentication removes these anonymous write paths.\n",
    "impact": "Integrations that push data to streaming or push datasets with a resource key (often IoT or\nPower Automate flows using the key URL) stop working. Move them to authenticated API calls with\na service principal or user identity before enabling the block.\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > Developer settings > Block ResourceKey Authentication",
      "default_value": "Disabled",
      "recommended_value": "Enabled"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **Developer settings** and\n   expand **Block ResourceKey Authentication**.\n3. Check that it is **Enabled**.\n4. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,\n   read the entry `BlockResourceKeyAuthentication` (`enabled` must be `true`).\n5. Fail if the block is disabled.\n"
    },
    "remediation": {
      "manual": "1. Identify streaming and push datasets fed with resource keys and move their sources to\n   authenticated API calls.\n2. In **Tenant settings** > **Developer settings** > **Block ResourceKey Authentication**,\n   select **Enabled** and **Apply**. Role: Fabric Administrator.\n3. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/BlockResourceKeyAuthentication/update`\n   with `{\"enabled\": true}`.\n",
      "rollback": "Set the setting back to **Disabled**.\n"
    },
    "references": [
      {
        "title": "Developer admin settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-developer",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power BI baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERBI.5.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1565.001"
      },
      {
        "framework": "mitre-attack",
        "id": "T1552"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}