Enable Power Platform tenant isolation

Description

Power Platform tenant isolation (Restrict cross-tenant connections) is turned On. Power Platform then blocks inbound and outbound connections that use Microsoft Entra ID-based connectors (Office 365 Outlook, SharePoint, OneDrive for Business, Dataverse...) between this tenant and any other tenant, except the tenants listed as exceptions.

Tenant isolation is specific to Power Platform connections. It does not replace Microsoft Entra cross-tenant access settings or tenant restrictions, and it does not cover connectors that do not use Entra authentication.

Rationale

Without isolation, a maker can build a flow that copies SharePoint files or mail into a SharePoint site or mailbox of another tenant they control, simply by signing in to the second tenant in the connection dialog. The reverse also works: a user of another tenant can connect to this tenant's data from their own environment. Tenant isolation closes this exfiltration channel and forces cross-tenant integrations to be declared.

Impact

Existing apps and flows that use cross-tenant connections fail at runtime about an hour after isolation is enabled, and makers can no longer create such connections. Run the cross-tenant isolation report first, and add the required partner tenants as exceptions (CB-M365-POWER-006). The Azure DevOps connector is a known gap: tenant isolation is not enforced for it, so limit it with data policies.

Setting

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader.
2. Browse to Security > Identity and access > Tenant isolation.
3. Check that Restrict cross-tenant connections is On.
4. Alternative, read only (Power Platform Administrator): Add-PowerAppsAccount, then Get-PowerAppTenantIsolationPolicy -TenantId <tenant ID> and read properties.isDisabled (must be False).
5. Fail if tenant isolation is off.

Remediation

1. Run the cross-tenant isolation report (Power Platform admin center, tenant isolation page or the reporting API) to list existing cross-tenant connections.
2. In Security > Identity and access > Tenant isolation, add exceptions for the partner tenants and directions that are required (CB-M365-POWER-006). Role: Power Platform Administrator.
3. Turn Restrict cross-tenant connections On and save.
4. PowerShell equivalent: read the policy with Get-PowerAppTenantIsolationPolicy, set properties.isDisabled to $false, and apply it with Set-PowerAppTenantIsolationPolicy.

Rollback

Turn Restrict cross-tenant connections Off, or add a temporary exception for the affected tenant.

References

• Restrict cross-tenant inbound and outbound access Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-006 Limit Power Platform tenant isolation exceptions to approved tenants
• related CB-M365-POWER-003 Apply a restrictive data policy to the default Power Platform environment
• related CB-M365-TENANT-014 Block cross-tenant B2B access by default and allow named partners

People and lifecycle