Cover every non-default Power Platform environment with a data policy

Description

Every Power Platform environment other than the default one (production, sandbox, trial, developer, Dataverse for Teams) is in the scope of at least one data policy. The simplest way is a tenant-wide baseline policy with scope Add all environments, which also covers environments created later, completed by environment-specific policies that open the connectors each solution needs.

Rationale

Data policies only apply to the environments in their scope. An environment left out, often a recent one or one created before the governance existed, lets makers combine business and consumer connectors freely. A tenant-wide baseline guarantees a minimum level everywhere, and the most restrictive policy wins when several apply.

Impact

Solutions in environments that had no policy may use connectors the new baseline blocks; they are suspended until the environment receives an adapted policy. Inventory connector usage per environment first, and agree the baseline connector classification with the solution owners.

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader.
2. Browse to Manage > Environments and list the environments.
3. Browse to Security > Data and privacy > Data policy and, using the Applied to column, check that every environment falls within the scope of at least one policy. A policy applied to All environments covers them all.
4. Alternative, read only (Power Platform Administrator): compare Get-AdminPowerAppEnvironment with the environment scopes returned by Get-DlpPolicy.
5. Fail if any non-default environment is outside every data policy.

Remediation

1. In Security > Data and privacy > Data policy, create (or edit) a baseline policy with scope Add all environments. Role: Power Platform Administrator.
2. Classify connectors as in the default environment policy (approved business connectors, everything else blockable in Blocked, default group Blocked, custom connectors denied by default).
3. For environments hosting reviewed solutions, add environment-level or tenant-level policies limited to those environments that place the required connectors in Business; the baseline policy keeps blocking everything else.

Rollback

Remove the environments from the policy scope, or delete the baseline policy.

References

• Manage data policies Microsoft, vendor-doc, accessed 2026-10-24
• Data policies Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-001 Restrict production and sandbox environment creation to administrators
• related CB-M365-POWER-003 Apply a restrictive data policy to the default Power Platform environment

People and lifecycle