TMA-POWERPLATFORM-2.5
Ensure 'Cross-tenant isolation is enabled for Power Platform Apps and Flows'
설명
Microsoft Power Platform has a rich ecosystem of connectors based on Azure Active Directory (Azure AD) that allow authorized Azure AD users to build compelling apps and flows establishing connections to the business data available through these data stores. Tenant isolation makes it easy for administrators to ensure that these connectors can be harnessed in a safe and secure way within the tenant while minimizing the risk of data exfiltration outside the tenant. Tenant isolation allows admins to effectively govern the movement of tenant data from Azure AD authorized data sources to and from their tenant. With tenant isolation On, all tenants are restricted. Inbound (connections to the tenant from external tenants) and outbound (connections from the tenant to external tenants) cross-tenant connections are blocked by Power Platform even if the user presents valid credentials to the Azur...
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Verify that cross-tenant isolation is enabled. In the Power Platform Admin Center: - Log in to https://admin.powerplatform.microsoft.com and select the appropriate environment. - Select Tenant isolation (preview). - Confirm that tenant isolation is on.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Ensure that tenant restrictions for outbound connections are setup: There are two steps to get started with tenant restrictions. First, make sure that clients can connect to the right addresses. Second, configure proxy infrastructure. 1. URLs and IP addresses: a. To use tenant restrictions, clients must be able to connect to the following Azure AD URLs to authenticate: login.microsoftonline.com, login.microsoft.com, and login.windows.net. b. Additionally, to access Office 365, clients must also be able to connect to the fully qualified domain names (FQDNs), URLs, and IP addresses defined in Office 365 URLs and IP address ranges. 2. Proxy configuration and requirements: a. The following configuration is required to enable tenant restrictions through the proxy infrastructure. This guidance is generic, refer to the proxy vendor's documentation for specific implementation steps. b. Prerequisites: 1. The proxy must be able to perform TLS interception, HTTP header insertion, and filter destinations using FQDNs/URLs. 2. Clients must trust the certificate chain presented by the proxy for TLS communications. For example, if certificates from an internal public key infrastructure (PKI) ar...
속성
- 운영 체제
- 모두
- 태그
- power-platformsaas
- 참고 자료
- CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 2.5 Ensure 'Cross-tenant isolation is enabled for Power Platform Apps and Flows'