What this check looks at
Checks Power BI’s “Guest users can access Microsoft Fabric” setting: whether every Entra guest can open Power BI and Fabric content shared with them, only named security groups, or none.
Checks Power BI’s “Guest users can access Microsoft Fabric” setting: whether every Entra guest can open Power BI and Fabric content shared with them, only named security groups, or none.
Guests reach Power BI through Entra B2B: once invited to the tenant for anything, a guest can be shared a report and open it with their own sign-in.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
Every guest account in Entra, from a supplier invited for one Teams chat years ago to an auditor long gone, can open any Power BI report or dataset someone shares with them. Guests are rarely reviewed, so access to company figures outlives the work it was given for.
At a recruitment agency, a contractor invited as a guest for a Teams project was later shared a commission dashboard by mistake, by picking the wrong name from the people picker. With guest access on for everyone, the report opened; nothing flagged that the viewer was external.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.1 asks for this setting to be restricted. ISO 27001 A.5.15 (access control) and the NCSC 10 Steps data security guidance cover who can reach the organisation’s data.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Find out who uses it on purpose and put them in a security group first, so restricting it does not stop work that is meant to happen.
Step by step
- Find who uses it. Ask the Power BI owners who relies on this, and make a security group for them in Entra, so restricting it does not stop work that is meant to happen.
- Restrict the setting. In the Microsoft Fabric admin portal, open Tenant settings → Export and sharing settings → Guest users can access Microsoft Fabric. Turn it off, or set it to apply to specific security groups only, and select Apply.
- Review what was already shared. Restricting the setting stops it from now on. Ask the owners of shared reports and semantic models to check who already has access through it, and remove what is no longer needed.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
People outside the chosen group can no longer do this in Power BI; what was already shared stays shared until it is removed.
How to confirm it worked
The Fabric admin portal shows the setting off, or on for specific security groups only, and the next assessment passes.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.15 Access controlA.5.19 Information security in supplier relationships |
| CISA SCuBA | MS.POWERBI.2.1v1 Guest access to the Power BI tenant disabled |
| CIS M365 | 9.1.1 Ensure guest user access is restricted |
| CIS Controls v8.1 | 6.1 Establish an access granting process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)