cirsec Baselines
Esc
Microsoft 365 tenant · Power Platform, Fabric & Copilot Studio

Restrict service principal profiles in Power BI to approved groups

When it fails: Any service principal can create and use Power BI profiles. Every service principal can create profiles that hold their own workspace permissions, which multiplies identities that are hard to review.

CB-M365-POWER-020lowactivemanualprofile baseline

Description

The Fabric tenant setting Allow service principals to create and use profiles (Developer settings) is Disabled, or Enabled only for specific security groups containing the service principals of approved multitenant embedding applications.

Rationale

Service principal profiles let one application act as many isolated identities, one per customer, each with its own workspace access. They are useful for Power BI Embedded ISV scenarios and useless elsewhere. Leaving the feature open to every service principal creates identities and permissions that do not appear in the usual Entra reviews; restricting it keeps them to the applications designed for it.

Impact

Applications outside the allowed groups can no longer create or use profiles. Only multitenant Power BI Embedded applications normally rely on this feature.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

LocationFabric admin portal > Tenant settings > Developer settings > Allow service principals to create and use profiles
RecommendedDisabled, or Enabled for specific security groups

Audit

  1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
  2. Open Settings > Admin portal > Tenant settings > Developer settings and expand Allow service principals to create and use profiles.
  3. Check that it is Disabled, or Enabled for Specific security groups only.
  4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry AllowServicePrincipalsCreateAndUseProfiles.
  5. Fail if the setting is enabled for the entire organization.

Remediation

  1. In Tenant settings > Developer settings > Allow service principals to create and use profiles, select Disabled, or Enabled with Specific security groups. Select Apply. Role: Fabric Administrator.
  2. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/AllowServicePrincipalsCreateAndUseProfiles/update with the target state.

Rollback

Set the setting back to its previous scope.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AC-6(5)related
NIST SP 800-53 Rev. 55.1.1AC-2related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.POWERBI.4.2v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1098.003
  • related CB-M365-POWER-019 Restrict Fabric public API access by service principals to approved groups
  • related CB-M365-APPS-001 Restrict application registration to administrators

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr