Restrict service principals from creating Fabric workspaces, connections and deployment pipelines

Description

The Fabric tenant setting Service principals can create workspaces, connections, and deployment pipelines (Developer settings) is Disabled, or Enabled only for specific security groups containing the service principals of approved automation (for example a CI/CD pipeline).

Rationale

The Create Workspace, Create Connection and Create Deployment Pipeline APIs are not protected by a Fabric permission model: once the tenant setting allows a service principal, it can create these objects freely. A compromised application secret can then be used to create workspaces outside governance or connections that reach external data stores with stored credentials. Limiting the setting to a reviewed automation group closes that path.

Impact

Automation whose service principal is outside the allowed groups can no longer create workspaces, connections or deployment pipelines. Microsoft disables this setting by default for new tenants; check existing CI/CD and provisioning scripts before restricting it in older tenants.

Applies when

Requires: Power BI / Microsoft Fabric

Setting

Audit

1. Sign in to Microsoft Fabric (https://app.fabric.microsoft.com) as a Fabric Administrator.
2. Open Settings > Admin portal > Tenant settings > Developer settings and expand Service principals can create workspaces, connections, and deployment pipelines.
3. Check that it is Disabled, or Enabled for Specific security groups only.
4. Alternative, read only: in GET https://api.fabric.microsoft.com/v1/admin/tenantsettings, read the entry ServicePrincipalAccessGlobalAPIs.
5. Fail if the setting is enabled for the entire organization.

Remediation

1. In Tenant settings > Developer settings > Service principals can create workspaces, connections, and deployment pipelines, select Disabled, or Enabled with Specific security groups. Select Apply. Role: Fabric Administrator.
2. API equivalent: POST https://api.fabric.microsoft.com/v1/admin/tenantsettings/ServicePrincipalAccessGlobalAPIs/update with the target state.

Rollback

Set the setting back to its previous scope.

References

• Developer admin settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-019 Restrict Fabric public API access by service principals to approved groups
• related CB-M365-APPS-001 Restrict application registration to administrators

People and lifecycle