What this check looks at
Checks the Power BI tenant setting that lets shareable links grant access to everyone in the organisation: whether anyone can make such a link, only named security groups, or no one.
Checks the Power BI tenant setting that lets shareable links grant access to everyone in the organisation: whether anyone can make such a link, only named security groups, or no one.
A link for specific people, or for people with existing access, keeps working with this off; only the "everyone in the organisation" option goes.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
A link that works for everyone in the organisation travels: forwarded in an email or pasted in a Teams channel, it opens the report for every member of staff, including people who should not see salaries, client margins or HR figures.
At an engineering firm, a finance analyst shared a salary-band report with a manager using an organisation-wide link, the default in the share dialogue. The manager forwarded it to the whole department to show the new bands, with every name and salary in it.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.7 asks for this setting to be restricted. ISO 27001 A.5.15 (access control) and the NCSC 10 Steps data security guidance cover who can reach the organisation’s data.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Find out who uses it on purpose and put them in a security group first, so restricting it does not stop work that is meant to happen.
Step by step
- Find who uses it. Ask the Power BI owners who relies on this, and make a security group for them in Entra, so restricting it does not stop work that is meant to happen.
- Restrict the setting. In the Microsoft Fabric admin portal, open Tenant settings → Export and sharing settings → Allow shareable links to grant access to everyone in your organisation. Turn it off, or set it to apply to specific security groups only, and select Apply.
- Review what was already shared. Restricting the setting stops it from now on. Ask the owners of shared reports and semantic models to check who already has access through it, and remove what is no longer needed.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
People outside the chosen group can no longer do this in Power BI; what was already shared stays shared until it is removed.
How to confirm it worked
The Fabric admin portal shows the setting off, or on for specific security groups only, and the next assessment passes.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transit |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.5.15 Access controlA.5.14 Information transfer |
| CIS M365 | 9.1.7 Ensure shareable links are restricted |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)