rules/findings/m365/microsoft_fabric/ms-fabric-allow-users-apply-sensitivity-labels-not-enabled.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "Fabric", "serviceName": "Microsoft 365", "displayName": "Ensure \u0027Allow users to apply sensitivity labels for content\u0027 is \u0027Enabled\u0027", "description": "\r\n\t\tInformation protection tenant settings help to protect sensitive information in the Power BI tenant. Allowing and applying sensitivity labels to content ensures that information is only seen and accessed by the appropriate users. \r\n\t\tThe recommended state is Enabled or Enabled for a subset of the organization. \r\n\t\t**Note** : Sensitivity labels and protection are only applied to files exported to Excel, PowerPoint, or PDF files, that are controlled by `Export to Excel` and `Export reports as PowerPoint presentation or PDF documents` settings. All other export and sharing options do not support the application of sensitivity labels and protection. \r\n\t\t**Note 2** : There are some prerequisite steps that need to be completed in order to fully utilize labelling. See here. \r\n ", "rationale": "Establishing data classifications and affixing labels to data at creation enables organizations to discern the data\u0027s criticality, sensitivity, and value. This initial identification enables the implementation of appropriate protective measures, utilizing technologies like Data Loss Prevention (DLP) to avert inadvertent exposure and enforcing access controls to safeguard against unauthorized access. This practice can also promote user awareness and responsibility in regard to the nature of the data they interact with. Which in turn can foster awareness in other areas of data management across the organization.", "impact": "Additional license requirements like Power BI Pro are required, as outlined in the Licensed and requirements page linked in the description and references sections.", "remediation": { "text": "\r\n\t\t\t###### Enable sensitivity labels: \r\n\t\t\t1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal \r\n\t\t\t2. Select Tenant settings. \r\n\t\t\t3. Scroll to Information protection. \r\n\t\t\t4. Set Allow users to apply sensitivity labels for content to one of these states: \r\n\t\t\t * State 1: Enabled \r\n\t\t\t * State 2: Enabled with Specific security groups selected and defined.\r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-enable-data-sensitivity-labels", "https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-dlp-policies-for-power-bi-overview", "https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-enable-data-sensitivity-labels#licensing-and-requirements" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "7.0.0", "reference": "9.1.6", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "m365_fabric_tenant", "subPath": null, "selectCondition":{ "conditions": [ [ "settingName", "eq", "EimInformationProtectionEdit" ] ] }, "query": [ { "filter": [ { "conditions": [ [ "enabled", "eq", "True" ], [ "enabledSecurityGroups.Count", "gt", "0" ] ], "operator": "and" } ] }, { "connectOperator": "or", "filter": [ { "conditions": [ [ "enabled", "eq", "True" ] ] } ] } ], "shouldExist": true, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "title": "Title", "tenantSettingGroup": "Group", "enabledSecurityGroups": "Security Groups", "enabled": "Enabled" }, "expandObject": null }, "table": "default", "decorate": [ { "itemName": "Enabled", "itemValue": "disabled", "className": "badge badge-danger badge-xl" } ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "title", "enabled", "location", "tenantSettingGroup", "enabledSecurityGroups" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ ], "message": "Ensure \u0027Allow users to apply sensitivity labels for content\u0027 is \u0027Enabled\u0027", "defaultMessage": "Ensure \u0027Allow users to apply sensitivity labels for content\u0027 is \u0027Enabled\u0027" }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "fabric_allow_users_apply_sensitivity_labels_not_enabled", "notes": [ ], "categories": [ ], "immutable_properties": [ ], "id": "microsoft365_2145" } |