What this check looks at
Checks Power BI’s “Users can invite guest users to collaborate through item sharing and permissions” setting: whether anyone can bring a new external person into the tenant by sharing a report, only named security groups, or none.
Checks Power BI’s “Users can invite guest users to collaborate through item sharing and permissions” setting: whether anyone can bring a new external person into the tenant by sharing a report, only named security groups, or none.
The invitation is sent by Power BI, not by the Entra guest invitation settings, so a tenant that restricts guest invitations in Entra can still gain guests this way unless this setting is restricted too.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
Sharing a report with an outside email address invites that person into Entra as a guest, so anyone with a Power BI licence can add guests to the tenant without IT’s usual guest process, and each one then sees what is shared with them.
At a logistics firm, IT had tightened who could invite guests in Entra, yet the guest list kept growing. Each new guest had been invited by a sales manager sharing a pipeline report with a client’s buyer; the reports showed every customer’s margins.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.2 asks for this setting to be restricted. ISO 27001 A.5.15 (access control) and the NCSC 10 Steps data security guidance cover who can reach the organisation’s data.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Find out who uses it on purpose and put them in a security group first, so restricting it does not stop work that is meant to happen.
Step by step
- Find who uses it. Ask the Power BI owners who relies on this, and make a security group for them in Entra, so restricting it does not stop work that is meant to happen.
- Restrict the setting. In the Microsoft Fabric admin portal, open Tenant settings → Export and sharing settings → Users can invite guest users to collaborate through item sharing and permissions. Turn it off, or set it to apply to specific security groups only, and select Apply.
- Review what was already shared. Restricting the setting stops it from now on. Ask the owners of shared reports and semantic models to check who already has access through it, and remove what is no longer needed.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
People outside the chosen group can no longer do this in Power BI; what was already shared stays shared until it is removed.
How to confirm it worked
The Fabric admin portal shows the setting off, or on for specific security groups only, and the next assessment passes.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.15 Access controlA.5.19 Information security in supplier relationships |
| CISA SCuBA | MS.POWERBI.3.1v1 Inviting external users disabled |
| CIS M365 | 9.1.2 Ensure external user invitations are restricted |
| CIS Controls v8.1 | 6.1 Establish an access granting process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)