Ensure Power Platform tenant isolation is enabled

HochStufe 2Automatisiertpower-platform

Beschreibung

Tenant isolation blocks connectors from authenticating to (and moving data to or from) other Microsoft Entra tenants. Set PP_TENANT_ID to the tenant GUID. Requires Microsoft.PowerApps.Administration.PowerShell and an authenticated session (Add-PowerAppsAccount) as a Power Platform administrator; the audit throws if the module is missing.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-TenantSettings -ErrorAction SilentlyContinue)) { throw 'Microsoft.PowerApps.Administration.PowerShell is not loaded: run Add-PowerAppsAccount first' }; if (-not $env:PP_TENANT_ID) { throw 'Set PP_TENANT_ID' }; $p = Get-PowerAppTenantIsolationPolicy -TenantId $env:PP_TENANT_ID -ErrorAction Stop; if ($p.properties -and $p.properties.isDisabled -eq $false) { 'compliant' } else { 'noncompliant' }

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Power Platform admin center > Security > Identity and access > Tenant isolation > On, adding allowed inbound/outbound tenants as needed (or Set-PowerAppTenantIsolationPolicy with properties.isDisabled = $false).

Eigenschaften

Betriebssysteme: Beliebig
Tags: power-platformdata-loss
Referenz: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - Tenant isolation (no dedicated CIS benchmark exists for Power Platform)

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target power-platform --level 2