The settings that actually matter (of the 170+)
Most are benign feature toggles; a small set are security-critical:
| Setting | Why it's dangerous | Sane posture |
|---|---|---|
| Publish to web | Makes a report PUBLICLY readable on the internet, no auth — the classic accidental data leak | Disabled, or tightly allowlisted |
| Export data / Export to Excel/CSV | Data walks out of the governed surface | Scoped to groups that need it |
| External sharing / guest access to content | Data reaches outside the tenant | Off or allowlisted per the org's stance |
| Allow service principals / developer APIs | Programmatic access to the whole estate | Scoped to specific security groups, audited |
| Information protection / sensitivity labels | Whether labels apply to Power BI content | On — the Purview tie-in |
How delegation works
Most settings support Enabled for the entire org / Disabled / Enabled for specific security groups (with exceptions). The governed pattern: disabled by default, enabled for a named group with a documented reason — the same least-privilege shape as every other workload. The trap is 'Enabled for the entire org' left on a dangerous toggle (publish-to-web especially) because nobody reviewed the default.
Why they drift — and why that's serv365's whole point
170+ settings, multiple admins, feature launches flipping defaults, and a 'temporary' enablement that outlives its reason — this surface drifts constantly. serv365 scans all 171 Fabric tenant settings nightly, canonicalises and diffs them: publish-to-web flipping on, an export control loosening, a new service-principal grant — each is a dated, attributed change, and the dangerous ones should page someone. A point-in-time 'we configured it right' is worth far less than 'nothing changed that we didn't intend'.
What to watch (proofs)
- The dangerous subset as alerts: publish-to-web, export, external sharing, service-principal access — their current state (nightly scan) with priority alerting on change; these are the settings attackers and mistakes flip.
- Delegation reality: for each critical setting, 'entire org' vs 'specific groups' — the org-wide-on-a-dangerous-toggle audit.
- Publish-to-web exposure: the admin portal's publish-to-web report lists every publicly-exposed report — run it; the findings are often alarming.
- Drift attribution: the Fabric activity log names who changed a tenant setting — an unexpected actor on a security toggle is an incident.