What this check looks at
Checks Power BI’s “Allow specific users to turn on external data sharing” setting: whether anyone can share a semantic model in place with another organisation, which then queries it from its own Power BI, only named security groups, or no one.
Checks Power BI’s “Allow specific users to turn on external data sharing” setting: whether anyone can share a semantic model in place with another organisation, which then queries it from its own Power BI, only named security groups, or no one.
The receiving organisation’s users query the model live; revoking the share stops it, but anything they have already exported stays with them.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
In-place sharing lets another organisation build its own reports on top of the shared model, in its own tenant. The data never leaves, but what they do with it, and who in their organisation sees it, is no longer under your control.
At a wholesale distributor, a product manager shared a sales model with a supplier so they could plan stock. The model included every customer’s order history and prices, which the supplier then used in its own negotiations with those customers.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.8 asks for this setting to be restricted. ISO 27001 A.5.15 (access control) and the NCSC 10 Steps data security guidance cover who can reach the organisation’s data.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Find out who uses it on purpose and put them in a security group first, so restricting it does not stop work that is meant to happen.
Step by step
- Find who uses it. Ask the Power BI owners who relies on this, and make a security group for them in Entra, so restricting it does not stop work that is meant to happen.
- Restrict the setting. In the Microsoft Fabric admin portal, open Tenant settings → Export and sharing settings → Allow specific users to turn on external data sharing. Turn it off, or set it to apply to specific security groups only, and select Apply.
- Review what was already shared. Restricting the setting stops it from now on. Ask the owners of shared reports and semantic models to check who already has access through it, and remove what is no longer needed.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
People outside the chosen group can no longer do this in Power BI; what was already shared stays shared until it is removed.
How to confirm it worked
The Fabric admin portal shows the setting off, or on for specific security groups only, and the next assessment passes.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transit |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.15 Access controlA.5.14 Information transferA.5.19 Information security in supplier relationships |
| CIS M365 | 9.1.8 Ensure enabling of external data sharing is restricted |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)