{
  "id": "CB-M365-POWER-020",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-020",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-020.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-020.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-020",
    "title": "Restrict service principal profiles in Power BI to approved groups",
    "finding": {
      "title": "Any service principal can create and use Power BI profiles",
      "description": "Every service principal can create profiles that hold their own workspace permissions, which multiplies identities that are hard to review."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "fabric",
      "power-bi",
      "service-principals",
      "embedded",
      "workload-identities"
    ],
    "applicability": {
      "requires": [
        "Power BI / Microsoft Fabric"
      ]
    },
    "description": "The Fabric tenant setting **Allow service principals to create and use profiles** (Developer\nsettings) is **Disabled**, or **Enabled** only for specific security groups containing the\nservice principals of approved multitenant embedding applications.\n",
    "rationale": "Service principal profiles let one application act as many isolated identities, one per\ncustomer, each with its own workspace access. They are useful for Power BI Embedded ISV scenarios\nand useless elsewhere. Leaving the feature open to every service principal creates identities and\npermissions that do not appear in the usual Entra reviews; restricting it keeps them to the\napplications designed for it.\n",
    "impact": "Applications outside the allowed groups can no longer create or use profiles. Only multitenant\nPower BI Embedded applications normally rely on this feature.\n",
    "setting": {
      "location": "Fabric admin portal > Tenant settings > Developer settings > Allow service principals to create and use profiles",
      "recommended_value": "Disabled, or Enabled for specific security groups"
    },
    "audit": {
      "manual": "1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.\n2. Open **Settings** > **Admin portal** > **Tenant settings** > **Developer settings** and\n   expand **Allow service principals to create and use profiles**.\n3. Check that it is **Disabled**, or **Enabled** for **Specific security groups** only.\n4. Alternative, read only: in `GET https://api.fabric.microsoft.com/v1/admin/tenantsettings`,\n   read the entry `AllowServicePrincipalsCreateAndUseProfiles`.\n5. Fail if the setting is enabled for the entire organization.\n"
    },
    "remediation": {
      "manual": "1. In **Tenant settings** > **Developer settings** > **Allow service principals to create and\n   use profiles**, select **Disabled**, or **Enabled** with **Specific security groups**. Select\n   **Apply**. Role: Fabric Administrator.\n2. API equivalent: `POST\n   https://api.fabric.microsoft.com/v1/admin/tenantsettings/AllowServicePrincipalsCreateAndUseProfiles/update`\n   with the target state.\n",
      "rollback": "Set the setting back to its previous scope.\n"
    },
    "references": [
      {
        "title": "Developer admin settings",
        "url": "https://learn.microsoft.com/fabric/admin/service-admin-portal-developer",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power BI baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerbi.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERBI.4.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(5)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-019",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}