rules/findings/m365/microsoft_fabric/ms-fabric-enabling-external-data-sharing-not-restricted.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "Fabric", "serviceName": "Microsoft 365", "displayName": "Ensure enabling of external data sharing is restricted", "description": "Power BI admins can specify which users or user groups can share datasets externally with guests from a different tenant through the in-place mechanism. Disabling this setting prevents any user from sharing datasets externally by restricting the ability of users to turn on external sharing for datasets they own or manage. The recommended state is Enabled for a subset of the organization or Disabled.", "rationale": "Establishing and enforcing a dedicated security group prevents unauthorized access to Microsoft Fabric for guests collaborating in Azure that are new or from other applications. This upholds the principle of least privilege and uses role-based access control (RBAC). These security groups can also be used for tasks like conditional access, enhancing risk management and user accountability across the organization.", "impact": "Security groups will need to be more closely tended to and monitored.", "remediation": { "text": "\r\n\t\t\t###### Restrict external data sharing: \r\n\t\t\t1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal \r\n\t\t\t2. Select Tenant settings. \r\n\t\t\t3. Scroll to Export and Sharing settings. \r\n\t\t\t4. Set Allow specific users to turn on external data sharing to one of these states: \r\n\t\t\t * State 1: Disabled \r\n\t\t\t * State 2: Enabled with Specific security groups selected and defined. \r\n\t\t\t**Important** : If the organization doesn\u0027t actively use this feature it is recommended to keep it `Disabled`. \r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-export-sharing" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "7.0.0", "reference": "9.1.8", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "m365_fabric_tenant", "subPath": null, "selectCondition":{ "conditions": [ [ "settingName", "eq", "EnableDatasetInPlaceSharing" ] ] }, "query": [ { "filter": [ { "conditions": [ [ "enabled", "eq", "True" ], [ "enabledSecurityGroups.Count", "gt", "0" ] ], "operator": "and" } ] }, { "connectOperator": "or", "filter": [ { "conditions": [ [ "enabled", "eq", "False" ] ] } ] } ], "shouldExist": true, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "title": "Title", "tenantSettingGroup": "Group", "enabledSecurityGroups": "Security Groups", "enabled": "Enabled" }, "expandObject": null }, "table": "default", "decorate": [ { "itemName": "Enabled", "itemValue": "enabled", "className": "badge badge-danger badge-xl" }, { "itemName": "Security Groups", "itemValue": "NotSet", "className": "badge badge-danger badge-xl" } ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "title", "enabled", "location", "tenantSettingGroup", "enabledSecurityGroups" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ ], "message": "Ensure enabling of external data sharing is restricted", "defaultMessage": "Ensure enabling of external data sharing is restricted" }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "fabric_enabling_external_data_sharing_not_restricted", "notes": [ ], "categories": [ ], "immutable_properties": [ ], "id": "microsoft365_2147" } |