{
  "id": "CB-M365-POWER-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-006.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-006",
    "title": "Limit Power Platform tenant isolation exceptions to approved tenants",
    "finding": {
      "title": "Power Platform tenant isolation exceptions are missing, too broad or unreviewed",
      "description": "The tenant isolation allow list contains wildcard entries or tenants without a documented business need, which reopens cross-tenant connections."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "power-platform",
      "tenant-isolation",
      "cross-tenant",
      "allowlist",
      "partners"
    ],
    "description": "The tenant isolation exception list contains only partner tenants with a documented business\nneed, each with the narrowest direction required (**Inbound**, **Outbound** or **Both**). No entry\nuses the `*` wildcard, which allows every tenant in a direction. The list is reviewed at least\nonce a year with the owners of the integrations. An empty list is compliant when no cross-tenant\nintegration exists.\n",
    "rationale": "Tenant isolation only protects as much as its exceptions allow. A `*` entry, added to stop\nbreaking flows when isolation was turned on, cancels the protection in that direction. Stale\nentries keep connections open to former partners. A short, reviewed list keeps cross-tenant data\nflows deliberate and traceable.\n",
    "impact": "Removing an exception breaks the apps and flows that use connections to that tenant in the\nremoved direction. Confirm with integration owners, using the cross-tenant isolation report,\nbefore removing entries.\n",
    "audit": {
      "manual": "1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at\n   least a Global Reader.\n2. Browse to **Security** > **Identity and access** > **Tenant isolation** and review the\n   exception list (tenant ID or domain, allowed direction).\n3. Check that no entry uses `*`, and that each tenant matches a documented, current integration\n   with the narrowest direction.\n4. Alternative, read only (Power Platform Administrator):\n   `(Get-PowerAppTenantIsolationPolicy -TenantId <tenant ID>).properties.allowedTenants`.\n5. Fail if a `*` entry exists, or if an entry has no documented owner and need.\n"
    },
    "remediation": {
      "manual": "1. Run the cross-tenant isolation report to see which tenants and directions are actually used.\n2. In **Security** > **Identity and access** > **Tenant isolation**, replace any `*` entry with\n   the specific tenants needed, narrow **Both** entries to **Inbound** or **Outbound** where\n   possible, and delete unused entries. Role: Power Platform Administrator.\n3. PowerShell equivalent: edit `properties.allowedTenants` in the object returned by\n   `Get-PowerAppTenantIsolationPolicy` and apply it with `Set-PowerAppTenantIsolationPolicy`.\n4. Record each remaining exception (partner, owner, direction, review date).\n",
      "rollback": "Add back the removed exception with its original direction.\n"
    },
    "references": [
      {
        "title": "Restrict cross-tenant inbound and outbound access",
        "url": "https://learn.microsoft.com/power-platform/admin/cross-tenant-restrictions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power Platform baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerplatform.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERPLATFORM.3.2v1",
        "relation": "stricter",
        "note": "SCuBA asks for an allow list; ours also forbids wildcard entries and requires a documented, reviewed need for each tenant."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7(5)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1537"
      },
      {
        "framework": "mitre-attack",
        "id": "T1199"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-005",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-014",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}