Ensure at least one data loss prevention (DLP) policy exists

AltaNivel 1Automatizadapower-platform

Descripción

Without a DLP policy every connector, including consumer services, can be combined freely in apps and flows. Prints the number of tenant DLP policies (expected at least one; compliant prints compliant). Requires Microsoft.PowerApps.Administration.PowerShell and an authenticated session (Add-PowerAppsAccount) as a Power Platform administrator; the audit throws if the module is missing.

Cómo se verifica

Método de auditoría: Comando de shell

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-TenantSettings -ErrorAction SilentlyContinue)) { throw 'Microsoft.PowerApps.Administration.PowerShell is not loaded: run Add-PowerAppsAccount first' }; $n = @(Get-AdminDlpPolicy -ErrorAction Stop).Count; if ($n -ge 1) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Power Platform admin center > Security > Data and privacy > Data policies > New policy: classify business connectors, block high-risk connectors, scope to all environments (or New-DlpPolicy).

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: power-platformdata-loss
Referencia: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - Data policies (DLP) (no dedicated CIS benchmark exists for Power Platform)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target power-platform