TMA-POWERPLATFORM-2.3
Ensure 'Set blocked file extensions' is configured to match the enterprise block list
Description
This setting prevents the upload or download of certain attachment types that are considered dangerous. Dynamics 365 comes with a predefined extensions list that is blocked in the tool; it is required to have it as restricted as possible, allowing just the extensions that are required for business purposes. Consider updating the blocked extensions periodically.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Verify the 'Set blocked file extensions' is configured to match the organizations block list. In the Power Platform Admin Center: 1. Log in to https://admin.powerplatform.microsoft.com and select the appropriate environment. 2. Select Settings. 3. Expand Product then select Privacy + Security. 4. Review the list extensions to ensure it matches the organizations block list.
How it is fixed
Fix method: Guidance or infrastructure patch
Ensure the 'Set blocked file extensions' is configured to match the organizations block list. In the Power Platform Admin Center: 1. Log in to https://admin.powerplatform.microsoft.com and select the appropriate environment. 2. Select Settings. 3. Expand Product then select Privacy + Security. 4. Add extensions as relevant to the organization.
Properties
- Operating systems
- Any
- Tags
- power-platformsaas
- Reference
- CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 2.3 Ensure 'Set blocked file extensions' is configured to match the enterprise block list