What this check looks at
Checks Power BI’s “Guest users can browse and access Fabric content” setting: whether guests can see the workspace and item lists and request access, only named security groups of them, or none.
Checks Power BI’s “Guest users can browse and access Fabric content” setting: whether guests can see the workspace and item lists and request access, only named security groups of them, or none.
Without it, a guest still opens what is shared with them directly by link or by name; browsing adds the lists and the request-access button.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
A guest who can browse sees the names of every workspace and report they can reach, and can ask for access to more. Names alone (“Redundancy plan 2027”, “Acquisition model”) can say more than the business intends.
At a charity, a volunteer treasurer set up as a guest could browse Power BI and saw a workspace named for a planned restructure before staff had been told. Nothing in it was opened; its name was enough.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.3 asks for this setting to be restricted. ISO 27001 A.5.15 (access control) and the NCSC 10 Steps data security guidance cover who can reach the organisation’s data.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Find out who uses it on purpose and put them in a security group first, so restricting it does not stop work that is meant to happen.
Step by step
- Find who uses it. Ask the Power BI owners who relies on this, and make a security group for them in Entra, so restricting it does not stop work that is meant to happen.
- Restrict the setting. In the Microsoft Fabric admin portal, open Tenant settings → Export and sharing settings → Guest users can browse and access Fabric content. Turn it off, or set it to apply to specific security groups only, and select Apply.
- Review what was already shared. Restricting the setting stops it from now on. Ask the owners of shared reports and semantic models to check who already has access through it, and remove what is no longer needed.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
People outside the chosen group can no longer do this in Power BI; what was already shared stays shared until it is removed.
How to confirm it worked
The Fabric admin portal shows the setting off, or on for specific security groups only, and the next assessment passes.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.15 Access control |
| CIS M365 | 9.1.3 Ensure guest access to content is restricted |
| CIS Controls v8.1 | 6.1 Establish an access granting process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)