Restrict Fabric public API access by service principals to approved groups

Description

The Fabric tenant setting Service principals can call Fabric public APIs (Developer settings) is Disabled, or Enabled only for specific security groups that contain the service principals of approved applications. Credentials of those service principals are stored in a key vault and reviewed with the other workload identities.

Rationale

Service principals authenticate without MFA or Conditional Access for users, often with long-lived secrets. If any of them can call Fabric APIs, a leaked secret of an unrelated application becomes a way to read or change analytics content wherever that principal was granted access. Allowing only a named group keeps API access to the applications that were reviewed for it.

Impact

Applications whose service principal is outside the allowed groups receive authorization errors on Fabric APIs. Microsoft enables this setting by default for new tenants: inventory the applications that use Fabric APIs (sign-in logs, admin monitoring) and add their service principals to the group before restricting.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Developer settings and expand Service principals can call Fabric public APIs.
3. Check that it is Disabled, or Enabled for Specific security groups whose members are approved service principals.
4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry ServicePrincipalAccessPermissionAPIs.
5. Fail if the setting is enabled for the entire organization.

Remediation

1. Create a security group for the service principals of approved applications and add them.
2. In Tenant settings > Developer settings > Service principals can call Fabric public APIs, select Disabled, or Enabled with Specific security groups and the group. Select Apply. Role: Fabric Administrator.
3. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/ServicePrincipalAccessPermissionAPIs/update with the target state.

Rollback

Set the setting back to its previous scope.

References

• Developer admin settings Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power BI baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-020 Restrict service principal profiles in Power BI to approved groups
• related CB-M365-POWER-021 Restrict service principals from creating Fabric workspaces, connections and deployment pipelines
• related CB-M365-APPS-001 Restrict application registration to administrators

People and lifecycle