Microsoft Power Platform
TMA-POWERPLATFORM-TENANT-ISOLATION
Ensure Power Platform tenant isolation is enabled
Descripción
Tenant isolation blocks connectors from authenticating to (and moving data to or from) other Microsoft Entra tenants. Set PP_TENANT_ID to the tenant GUID. Requires Microsoft.PowerApps.Administration.PowerShell and an authenticated session (Add-PowerAppsAccount) as a Power Platform administrator; the audit throws if the module is missing.
Cómo se verifica
Método de auditoría: Comando de shell
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-TenantSettings -ErrorAction SilentlyContinue)) { throw 'Microsoft.PowerApps.Administration.PowerShell is not loaded: run Add-PowerAppsAccount first' }; if (-not $env:PP_TENANT_ID) { throw 'Set PP_TENANT_ID' }; $p = Get-PowerAppTenantIsolationPolicy -TenantId $env:PP_TENANT_ID -ErrorAction Stop; if ($p.properties -and $p.properties.isDisabled -eq $false) { 'compliant' } else { 'noncompliant' }- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Power Platform admin center > Security > Identity and access > Tenant isolation > On, adding allowed inbound/outbound tenants as needed (or Set-PowerAppTenantIsolationPolicy with properties.isDisabled = $false).
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- power-platformdata-loss
- Referencia
- CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - Tenant isolation (no dedicated CIS benchmark exists for Power Platform)
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target power-platform --level 2