{
  "id": "CB-M365-POWER-004",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-004",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-004.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-004.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-004",
    "title": "Cover every non-default Power Platform environment with a data policy",
    "finding": {
      "title": "Some Power Platform environments have no data policy",
      "description": "Apps, flows and agents in these environments can combine any connectors, so business data can flow to external services without restriction."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "power-platform",
      "data-policy",
      "dlp",
      "connectors",
      "environments"
    ],
    "description": "Every Power Platform environment other than the default one (production, sandbox, trial,\ndeveloper, Dataverse for Teams) is in the scope of at least one data policy. The simplest way is\na tenant-wide baseline policy with scope **Add all environments**, which also covers\nenvironments created later, completed by environment-specific policies that open the connectors\neach solution needs.\n",
    "rationale": "Data policies only apply to the environments in their scope. An environment left out, often a\nrecent one or one created before the governance existed, lets makers combine business and\nconsumer connectors freely. A tenant-wide baseline guarantees a minimum level everywhere, and the\nmost restrictive policy wins when several apply.\n",
    "impact": "Solutions in environments that had no policy may use connectors the new baseline blocks; they are\nsuspended until the environment receives an adapted policy. Inventory connector usage per\nenvironment first, and agree the baseline connector classification with the solution owners.\n",
    "audit": {
      "manual": "1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at\n   least a Global Reader.\n2. Browse to **Manage** > **Environments** and list the environments.\n3. Browse to **Security** > **Data and privacy** > **Data policy** and, using the **Applied to**\n   column, check that every environment falls within the scope of at least one policy. A policy\n   applied to **All environments** covers them all.\n4. Alternative, read only (Power Platform Administrator): compare\n   `Get-AdminPowerAppEnvironment` with the environment scopes returned by `Get-DlpPolicy`.\n5. Fail if any non-default environment is outside every data policy.\n"
    },
    "remediation": {
      "manual": "1. In **Security** > **Data and privacy** > **Data policy**, create (or edit) a baseline policy\n   with scope **Add all environments**. Role: Power Platform Administrator.\n2. Classify connectors as in the default environment policy (approved business connectors,\n   everything else blockable in **Blocked**, default group **Blocked**, custom connectors\n   denied by default).\n3. For environments hosting reviewed solutions, add environment-level or tenant-level policies\n   limited to those environments that place the required connectors in **Business**; the\n   baseline policy keeps blocking everything else.\n",
      "rollback": "Remove the environments from the policy scope, or delete the baseline policy.\n"
    },
    "references": [
      {
        "title": "Manage data policies",
        "url": "https://learn.microsoft.com/power-platform/admin/prevent-data-loss",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Data policies",
        "url": "https://learn.microsoft.com/power-platform/admin/wp-data-loss-prevention",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power Platform baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerplatform.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERPLATFORM.2.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7(10)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-001",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-003",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}