Enforce Content Security Policy for model-driven and canvas apps

Description

In every Power Platform environment with a Dataverse database, the Privacy + Security settings enforce Content Security Policy for both app types: Enforce content security policy is On for Model-driven and for Canvas. The frame-ancestors directive keeps its default value ('self' https://*.powerapps.com) or lists only the approved hosts that embed the apps (Teams, Outlook, Power BI, intranet).

Rationale

An enforced CSP header tells the browser which origins may frame the app and load resources. Without it, a malicious site can embed a Power App in a hidden frame and trick users into clicking (clickjacking), and injected content is not constrained by the browser. Turning on enforcement is a low-cost, platform-provided layer of defense.

Impact

Apps embedded in hosts not listed in frame-ancestors stop loading in those hosts. Strict mode can block custom scripts or resources loaded from other origins. Enable reporting with an endpoint first (report-only mode), enforce on a test environment, then in production once no violation is reported. Environments without Dataverse are out of scope.

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader, or as an environment admin of each environment.
2. Browse to Manage > Environments and, for each environment with Dataverse, select it, then Settings > Product > Privacy + Security.
3. Under Content security policy, check on both the Model-driven and Canvas pivots that Enforce content security policy is On, and review the frame-ancestors sources.
4. Alternative, read only: Dataverse Web API GET https://<org>.crm.dynamics.com/api/data/v9.2/organizations?$select=iscontentsecuritypolicyenabled,iscontentsecuritypolicyenabledforcanvas,contentsecuritypolicyconfiguration with a user who can read the organization table.
5. Fail if enforcement is off for either app type in any Dataverse environment, or if frame-ancestors contains a wildcard host.

Remediation

1. For each Dataverse environment, browse to Manage > Environments > select it > Settings > Product > Privacy + Security. Role: Power Platform Administrator, or System Administrator of the environment.
2. Turn on Enable reporting with a reporting endpoint, and leave enforcement off for a few days to collect violations (report-only mode).
3. Add the legitimate embedding hosts to frame-ancestors (for example https://teams.microsoft.com/ for Teams integration).
4. Turn on Enforce content security policy on the Model-driven pivot, then on the Canvas pivot, starting with test environments.
5. Equivalent: set the organization columns iscontentsecuritypolicyenabled and iscontentsecuritypolicyenabledforcanvas to true through the Dataverse Web API.

Rollback

Turn Enforce content security policy off for the affected app type; keep reporting on.

References

• Content security policy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle