What this check looks at
Checks Power BI’s “Publish to web” tenant setting: whether anyone in the organisation can publish a report to a public web page, or only named security groups, or no one.
Power BI’s Publish to web makes an embed code for a report: a public address, and a snippet to put it on any web page. Whoever has the address sees the report and its data, with no sign-in and no licence, and Microsoft does not record who looked.
This check reads the Publish to web tenant setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
The setting is on for everyone by default in many older tenants, and people use it as a quick way to share a dashboard with someone outside, not realising the link is public.
Why it matters
Publish to web puts a report on the open internet: anyone with the address sees it, without signing in, and search engines can find it. A report built on payroll, client or pipeline data and published for a quick share is out for good, and Power BI keeps no record of who looked.
At a property management firm, an analyst published a rent-arrears dashboard to the web to show it to a contractor. It listed tenants’ names and what they owed. The address was later posted in a forum thread, and the firm only learned of it when a tenant searched their own name.
An embed code keeps working after the person who made it leaves, and anyone can copy the address on. Deleting it is the only way back, which is why the admin portal’s list of embed codes is worth a look even when the setting is changed.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.4 asks for Publish to web to be restricted. ISO 27001 A.5.14 (information transfer) and the NCSC 10 Steps data security guidance cover data leaving through sharing.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings → Export and sharing settings
Before you start
- Find out who publishes public reports on purpose (a marketing team, a public data page) and put them in a security group first.
- Admin portal → Embed codes lists every report already public: review it before turning the setting off.
Step by step
- See what is already public. In the Microsoft Fabric admin portal, open Embed codes. Each published report is listed with who published it. Ask each owner whether it is meant to be public, and delete the ones that are not.
- Restrict the setting. Open Tenant settings → Export and sharing settings → Publish to web. Turn it off, or set it to apply to specific security groups only, with a group for the few people who publish public reports.
- Stop new embed codes for everyone else. Under Choose how embed codes work, choose Only allow existing codes, so people outside the group cannot make new ones.
- Confirm it. Reopen the setting to check it saved. The finding clears at the next assessment.
What users will notice
People outside the chosen group can no longer publish a report to the web; embed codes already made keep working unless they are deleted.
How to confirm it worked
The Fabric admin portal shows Publish to web off, or on for specific security groups only, and the next assessment passes.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transit |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.14 Information transferA.8.12 Data leakage prevention |
| CISA SCuBA | MS.POWERBI.1.1v1 Publish to web disabled |
| CIS M365 | 9.1.4 Ensure 'Publish to web' is restricted |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Publish to web from Power BI (Microsoft Learn)