What this check looks at
Checks Power BI’s “Allow service principals to create and use profiles” setting: whether any app can create profiles (separate identities for each customer of a multi-tenant app), only apps in named security groups, or none.
Checks Power BI’s “Allow service principals to create and use profiles” setting: whether any app can create profiles (separate identities for each customer of a multi-tenant app), only apps in named security groups, or none.
Profiles are used by software vendors that embed Power BI for many customers. A business that does not embed reports for others rarely needs it at all.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
Profiles let one app act as many separate identities in Power BI. Without a restriction, any app can create them, which makes it harder to see which identity holds access to which workspace.
At a software reseller, a test app created dozens of profiles while a developer tried out Power BI Embedded. The profiles kept their workspace access after the test ended, each showing in audits only as a profile id.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.11 covers this setting. ISO 27001 A.5.16 Identity management and the NCSC 10 Steps data security guidance apply.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- List the apps that use it on purpose and put them in a security group first, so restricting it does not stop an integration that is meant to run.
Step by step
- Check who relies on it. Before changing it, ask the Power BI owners and developers whether anything depends on the current setting, so the change does not stop work that is meant to happen.
- Change the setting. In the Microsoft Fabric admin portal, open Tenant settings → Developer settings → Allow service principals to create and use profiles. Turn it off, or apply it to specific security groups only. Select Apply.
- Tell the people affected. Let the owners of any app outside the group know it can no longer do this, and add it to the group if it should.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
Apps outside the chosen group can no longer do this in Power BI.
How to confirm it worked
The Fabric admin portal shows the setting as the check asks, and the next assessment passes.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege |
| CMMC Level 2 | AC.L2-3.1.5 Least Privilege |
| ISO 27001:2022 | A.5.16 Identity managementA.5.15 Access control |
| CISA SCuBA | MS.POWERBI.4.2v1 Service principals creating profiles limited to security groups |
| CIS M365 | 9.1.11 Ensure service principals cannot create and use profiles |
| CIS Controls v8.1 | 6.8 Define and maintain role-based access control (IG3) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)