What this check looks at
Checks Power BI’s “Interact with and share R and Python visuals” setting: whether reports can run R and Python scripts to draw visuals.
Checks Power BI’s “Interact with and share R and Python visuals” setting: whether reports can run R and Python scripts to draw visuals.
Turning it off stops the visuals drawing in the Power BI service; the reports still open, with the R or Python visuals left blank.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off and fails when it is on. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
An R or Python visual runs code written by the report’s author whenever the report is opened. A script can send the data it is given anywhere it likes, and few people who open a report would know one is there.
At a market research agency, a contractor’s report used a Python visual that, besides drawing a chart, posted the respondent data it was given to an outside address. It ran each time the client opened the report, for months.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.5 covers this setting. ISO 27001 A.8.9 Configuration management and the NCSC 10 Steps data security guidance apply.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Ask the analysts whether any report relies on R or Python visuals before turning them off.
Step by step
- Check who relies on it. Before changing it, ask the Power BI owners and developers whether anything depends on the current setting, so the change does not stop work that is meant to happen.
- Change the setting. In the Microsoft Fabric admin portal, open Tenant settings → R and Python visuals settings → Interact with and share R and Python visuals. Turn it off. Select Apply.
- Tell the people affected. Tell report authors that R and Python visuals no longer draw in the Power BI service.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
Reports with R or Python visuals open with those visuals blank in the Power BI service.
How to confirm it worked
The Fabric admin portal shows the setting as the check asks, and the next assessment passes.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.4.6 Employ the principle of least functionality |
| CMMC Level 2 | CM.L2-3.4.6 Least Functionality |
| ISO 27001:2022 | A.8.9 Configuration management |
| CISA SCuBA | MS.POWERBI.6.1v1 Python and R interactions disabled |
| CIS M365 | 9.1.5 Ensure 'Interact with and share R and Python' visuals is 'Disabled' |
| CIS Controls v8.1 | 4.8 Uninstall or disable unnecessary services on enterprise assets and software (IG2) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)