Detections
Analytics

9.1.5 (L2) Ensure 'Interact with and share R and Python' visuals is 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Power BI allows the integration of R and Python scripts directly into visuals. This feature allows data visualizations by incorporating custom calculations, statistical analyses, machine learning models, and more using R or Python scripts. Custom visuals can be created by embedding them directly into Power BI reports. Users can then interact with these visuals and see the results of the custom code within the Power BI interface.

Disabling this feature can reduce the attack surface by preventing potential malicious code execution leading to data breaches, or unauthorized access. The potential for sensitive or confidential data being leaked to unintended users is also increased with the use of scripts.

Solution

To remediate using the UI:

 - Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal
 - Select Tenant settings.
 - Scroll to R and Python visuals settings.
 - Set Interact with and share R and Python visuals to Disabled

Impact:

Use of R and Python scripting will require exceptions for developers, along with more stringent code review.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: microsoft_azure

Control ID: 9195dba236b2e7ad221f545b64b4beb2e6b3b7eac4a8a70b340a9ec1147a2462