{
  "id": "CB-M365-POWER-001",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-001",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-001.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-001.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-001",
    "title": "Restrict production and sandbox environment creation to administrators",
    "finding": {
      "title": "Any licensed user can create production and sandbox Power Platform environments",
      "description": "Users can create new environments outside the data policies and security settings administrators maintain."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "power-platform",
      "environments",
      "governance",
      "least-privilege"
    ],
    "description": "The Power Platform tenant setting **Production environment assignments** is set to **Only\nspecific admins**. Only Global Administrators, Dynamics 365 Administrators and Power Platform\nAdministrators can then create production and sandbox environments; users request new\nenvironments through the platform team.\n",
    "rationale": "An environment created by a maker is outside the review of the platform team: data policies\nscoped to listed environments do not cover it, its security roles and sharing are set by the\ncreator, and it can hold a Dataverse database with business data that nobody inventories.\nRestricting creation keeps every production or sandbox environment known, assigned to an owner\nand covered by data policies.\n",
    "impact": "Makers can no longer create production or sandbox environments themselves. Provide a request\nprocess (for example a form handled by the platform team, or environment groups with rules).\nEnvironments created before the change remain manageable by their creators.\n",
    "setting": {
      "location": "Power Platform admin center > Manage > Tenant settings > Production environment assignments",
      "default_value": "Everyone",
      "recommended_value": "Only specific admins"
    },
    "audit": {
      "manual": "1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at\n   least a Global Reader.\n2. Browse to **Manage** > **Tenant settings** and open **Production environment assignments**.\n3. Check that it is set to **Only specific admins**.\n4. Alternative, read only (Power Platform Administrator): with the\n   `Microsoft.PowerApps.Administration.PowerShell` module, run `Add-PowerAppsAccount`, then\n   `(Get-TenantSettings).disableEnvironmentCreationByNonAdminUsers`.\n5. Fail if the setting is **Everyone** (`disableEnvironmentCreationByNonAdminUsers` is\n   `False`).\n"
    },
    "remediation": {
      "manual": "1. In the Power Platform admin center, browse to **Manage** > **Tenant settings** >\n   **Production environment assignments**. Role: Power Platform Administrator.\n2. Select **Only specific admins** and **Save**.\n3. PowerShell equivalent: `Set-TenantSettings -RequestBody @{\n   disableEnvironmentCreationByNonAdminUsers = $true }`.\n4. Review the existing environments (**Manage** > **Environments**) and assign an owner and a\n   data policy to each.\n",
      "rollback": "Set **Production environment assignments** back to **Everyone**.\n"
    },
    "references": [
      {
        "title": "Control environment creation and management",
        "url": "https://learn.microsoft.com/power-platform/admin/control-environment-creation",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power Platform baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerplatform.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERPLATFORM.1.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(10)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-5",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-002",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-004",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}