Detections
Analytics

9.1.11 (L1) Ensure service principals cannot create and use profiles

Information

Service principal profiles provide a flexible solution for apps used in a multitenancy deployment. The profiles enable customer data isolation and tighter security boundaries between customers that are utilizing the app.

The recommended state is Enabled for a subset of the organization or Disabled.

Service Principals should be restricted to a security group to limit which Service Principals can interact with profiles. This supports the principle of least privilege.

Solution

To remediate using the UI:

 - Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal
 - Select Tenant settings.
 - Scroll to Developer settings.
 - Set Allow service principals to create and use profiles to one of these states:
 - State 1: Disabled
 - State 2: Enabled with Specific security groups selected and defined.

Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.

Impact:

Disabled is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: microsoft_azure

Control ID: 66d3340ee36ec11448d89593a3112f525f9575a90e999e88f47bf82c99ef7d69