TMA-POWERPLATFORM-ENV-CREATION

Ensure production environment creation is restricted to administrators

MittelStufe 1Automatisiertpower-platform

Beschreibung

Unrestricted environment creation leads to unmanaged environments outside DLP and backup governance. Requires Microsoft.PowerApps.Administration.PowerShell and an authenticated session (Add-PowerAppsAccount) as a Power Platform administrator; the audit throws if the module is missing.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-TenantSettings -ErrorAction SilentlyContinue)) { throw 'Microsoft.PowerApps.Administration.PowerShell is not loaded: run Add-PowerAppsAccount first' }; $s = Get-TenantSettings -ErrorAction Stop; if ($s.disableEnvironmentCreationByNonAdminUsers -eq $true) { 'compliant' } else { 'noncompliant' }

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Power Platform admin center > Settings > Tenant settings > Production environment assignments > Only specific admins (or $s = Get-TenantSettings; $s.disableEnvironmentCreationByNonAdminUsers = $true; Set-TenantSettings -RequestBody $s).

Eigenschaften

Betriebssysteme: Beliebig
Tags: power-platformgovernance
Referenz: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - Environment creation (no dedicated CIS benchmark exists for Power Platform)

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target power-platform