Limit Power Platform tenant isolation exceptions to approved tenants

Description

The tenant isolation exception list contains only partner tenants with a documented business need, each with the narrowest direction required (Inbound, Outbound or Both). No entry uses the * wildcard, which allows every tenant in a direction. The list is reviewed at least once a year with the owners of the integrations. An empty list is compliant when no cross-tenant integration exists.

Rationale

Tenant isolation only protects as much as its exceptions allow. A * entry, added to stop breaking flows when isolation was turned on, cancels the protection in that direction. Stale entries keep connections open to former partners. A short, reviewed list keeps cross-tenant data flows deliberate and traceable.

Impact

Removing an exception breaks the apps and flows that use connections to that tenant in the removed direction. Confirm with integration owners, using the cross-tenant isolation report, before removing entries.

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader.
2. Browse to Security > Identity and access > Tenant isolation and review the exception list (tenant ID or domain, allowed direction).
3. Check that no entry uses *, and that each tenant matches a documented, current integration with the narrowest direction.
4. Alternative, read only (Power Platform Administrator): (Get-PowerAppTenantIsolationPolicy -TenantId <tenant ID>).properties.allowedTenants.
5. Fail if a * entry exists, or if an entry has no documented owner and need.

Remediation

1. Run the cross-tenant isolation report to see which tenants and directions are actually used.
2. In Security > Identity and access > Tenant isolation, replace any * entry with the specific tenants needed, narrow Both entries to Inbound or Outbound where possible, and delete unused entries. Role: Power Platform Administrator.
3. PowerShell equivalent: edit properties.allowedTenants in the object returned by Get-PowerAppTenantIsolationPolicy and apply it with Set-PowerAppTenantIsolationPolicy.
4. Record each remaining exception (partner, owner, direction, review date).

Rollback

Add back the removed exception with its original direction.

References

• Restrict cross-tenant inbound and outbound access Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-005 Enable Power Platform tenant isolation
• related CB-M365-TENANT-014 Block cross-tenant B2B access by default and allow named partners

People and lifecycle