To enforce access control for embedded reports and prevent public sharing, which tenant setting should you disable?

To enforce access control for embedded reports and prevent public sharing, which tenant setting should you disable?

• A. Disable External Content
• B. Disable Analyze in Excel
• C. Disable XMLA endpoints
• D. Disable Publish to web

Answer: (C)

Disabling the XMLA endpoints blocks the XMLA protocol, which is a common way external tools and apps connect directly to a Fabric data model to query data or metadata. When these endpoints are on, embedded reports or external analytics clients can reach the dataset outside the standard, governed UI, potentially bypassing some access controls and enabling unintended sharing. Turning off the XMLA endpoints enforces a stricter access path: only the service and authenticated users through the official channels can access the data, making it harder for embedded reports to be accessed publicly or teased apart from intended permissions. Other options address different vectors—external content, Excel analytics connections, or public publishing—yet they don’t specifically close the direct, programmatic access that XMLA endpoints provide, which is why disabling XMLA endpoints is the most targeted move for tightening access control around embedded reports and preventing unintended exposure.

Disabling the XMLA endpoints blocks the XMLA protocol, which is a common way external tools and apps connect directly to a Fabric data model to query data or metadata. When these endpoints are on, embedded reports or external analytics clients can reach the dataset outside the standard, governed UI, potentially bypassing some access controls and enabling unintended sharing. Turning off the XMLA endpoints enforces a stricter access path: only the service and authenticated users through the official channels can access the data, making it harder for embedded reports to be accessed publicly or teased apart from intended permissions.

Other options address different vectors—external content, Excel analytics connections, or public publishing—yet they don’t specifically close the direct, programmatic access that XMLA endpoints provide, which is why disabling XMLA endpoints is the most targeted move for tightening access control around embedded reports and preventing unintended exposure.