What this check looks at
Checks Power BI’s “Service principals can create workspaces, connections, and deployment pipelines” setting: whether any app can create them, only apps in named security groups, or none.
Checks Power BI’s “Service principals can create workspaces, connections, and deployment pipelines” setting: whether any app can create them, only apps in named security groups, or none.
Microsoft split this from the general API setting in 2025 and ships it off; a tenant where it is on had it turned on by someone.
This check reads the setting through the Microsoft Fabric admin API. It passes when the setting is off, or on only for named security groups, and fails when it is on for the whole organisation. It needs the client’s Fabric administrator to allow service principals to use the read-only admin APIs; until then it shows as not checked, with the step to take.
Why it matters
An app that can create workspaces and connections can set up places to hold data, and links to outside data sources, with no person involved. Left open, it is a route for data to be gathered where nobody is looking.
At an insurance broker, an automation app was given this to build reporting workspaces. It also created a connection to an outside database for a one-off import, which stayed in place with stored credentials long after the project ended.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 9.1.12 covers this setting. ISO 27001 A.8.9 Configuration management and the NCSC 10 Steps data security guidance apply.
How to fix it
Where: Microsoft Fabric admin portal → Tenant settings
Before you start
- List the apps that use it on purpose and put them in a security group first, so restricting it does not stop an integration that is meant to run.
Step by step
- Check who relies on it. Before changing it, ask the Power BI owners and developers whether anything depends on the current setting, so the change does not stop work that is meant to happen.
- Change the setting. In the Microsoft Fabric admin portal, open Tenant settings → Developer settings → Service principals can create workspaces, connections, and deployment pipelines. Turn it off, or apply it to specific security groups only. Select Apply.
- Tell the people affected. Let the owners of any app outside the group know it can no longer do this, and add it to the group if it should.
- Confirm it. Reopen the setting to check it saved; Microsoft can take up to 15 minutes to apply it. The finding clears at the next assessment.
What users will notice
Apps outside the chosen group can no longer do this in Power BI.
How to confirm it worked
The Fabric admin portal shows the setting as the check asks, and the next assessment passes.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.4.2 Establish and enforce security configuration settings |
| CMMC Level 2 | CM.L2-3.4.2 Security Configuration Enforcement |
| ISO 27001:2022 | A.8.9 Configuration managementA.5.15 Access control |
| CIS M365 | 9.1.12 Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- About tenant settings in the Fabric admin portal (Microsoft Learn)