What this check looks at
Checks Power BI’s “Block ResourceKey Authentication” setting: whether pushing data into a streaming semantic model needs a signed-in identity, rather than a key in the URL.
Checks Power BI’s “Block ResourceKey Authentication” setting: whether pushing data into a streaming semantic model needs a signed-in identity, rather than a key in the URL.
Turning the block on stops streaming datasets that are fed only by their key; their feeds have to sign in through the Power BI REST API instead.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is on and fails when it is off. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
A streaming dataset’s ResourceKey is part of a URL. Anyone who finds it, in a script, a log or a forum post, can push made-up figures into dashboards people use to make decisions, with nothing to show who did it.
At a manufacturer, a production dashboard on the shop floor was fed by a streaming dataset whose key sat in a script on a shared drive. A former contractor still had a copy, and the dashboard briefly showed a line stopped that was running.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.9 covers this setting. ISO 27001 A.8.5 Secure authentication and the NCSC 10 Steps data security guidance apply.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- Find any streaming dataset fed by its key alone, and move its feed to the Power BI REST API with a signed-in identity first.
Step by step
- Check who relies on it. Before changing it, ask the Power BI owners and developers whether anything depends on the current setting, so the change does not stop work that is meant to happen.
- Change the setting. In the Microsoft Fabric admin portal, open Tenant settings → Developer settings → Block ResourceKey Authentication. Turn it on. Select Apply.
- Tell the people affected. Tell the owners of streaming dashboards that feeds now need a signed-in identity.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
None for people reading reports; the setting adds a protection.
How to confirm it worked
The Fabric admin portal shows the setting as the check asks, and the next assessment passes.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CISA SCuBA | MS.POWERBI.5.1v1 ResourceKey-based authentication blocked |
| CIS M365 | 9.1.9 Ensure 'Block ResourceKey Authentication' is 'Enabled' |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)