How to restrict which apps can call Power BI’s APIs

What this check looks at

Checks Power BI’s “Service principals can call Fabric public APIs” setting: whether any app in Entra with the right permissions can use Power BI’s APIs, only apps in named security groups, or none.

ConfigCheckup’s own read uses a different setting (the read-only admin APIs); restricting this one does not stop it.

This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.

Why it matters

Any app registration given Power BI permissions can read and change reports and data through the API, without a person signing in. Limiting it to a group means each app that can do so has been added on purpose.

At a housing association, an old integration app set up by a departed developer still held Power BI permissions and a valid secret. With API access open to every app, it could read every workspace it had been added to, and nobody remembered it existed.

CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.10 covers this setting. ISO 27001 A.5.15 Access control and the NCSC 10 Steps data security guidance apply.

How to fix it

Where: Microsoft Fabric admin portal → Tenant settings

Before you start

List the apps that use it on purpose and put them in a security group first, so restricting it does not stop an integration that is meant to run.

Step by step

Check who relies on it. Before changing it, ask the Power BI owners and developers whether anything depends on the current setting, so the change does not stop work that is meant to happen.
Change the setting. In the Microsoft Fabric admin portal, open Tenant settings → Developer settings → Service principals can call Fabric public APIs. Turn it off, or apply it to specific security groups only. Select Apply.
Tell the people affected. Let the owners of any app outside the group know it can no longer do this, and add it to the group if it should.
Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.

What users will notice

Apps outside the chosen group can no longer do this in Power BI.

How to confirm it worked

The Fabric admin portal shows the setting as the check asks, and the next assessment passes.

Frameworks and controls

This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The frameworks and controls NL-COL-026 maps to
Framework	Control
NCSC CAF	B2.a Identity verification, authentication and authorisation
DSPT	Standard 1: Personal confidential data
Microsoft Cloud Security Benchmark	DP-2 Monitor anomalies and threats targeting sensitive data
Zero Trust	Data
SOC 2	CC6.1 Logical access security software, infrastructure and architectures
NIST SP 800-171	3.1.5 Employ the principle of least privilege
CMMC Level 2	AC.L2-3.1.5 Least Privilege
ISO 27001:2022	A.5.15 Access controlA.8.2 Privileged access rights
CISA SCuBA	MS.POWERBI.4.1v1 Service principals with API access limited to security groups
CIS M365	9.1.10 Ensure access to APIs by service principals is restricted
CIS Controls v8.1	6.8 Define and maintain role-based access control (IG3)
NIST CSF 2.0	PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NCSC 10 Steps	Data security

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

About tenant settings in the Fabric admin portal (Microsoft Learn)

The full Microsoft 365 security checklist, worst first