Description
The Power Platform tenant setting disablePortalsCreationByNonAdminUsers is true. Only Dynamics
365 Administrators and Power Platform Administrators can create Power Pages sites; makers request
a site from the platform team, which reviews its exposure, authentication and table permissions.
The setting has no switch in the Power Platform admin center and is managed with PowerShell or the Power Platform API.
Rationale
A Power Pages site is an internet-facing web application on top of Dataverse. A maker who misconfigures table permissions or anonymous access can expose business records to the whole internet, which has happened repeatedly in real incidents. Restricting site creation ensures each public site is reviewed before it exists.
Impact
Makers who try to create a site get a permission error and must go through the platform team. Existing sites are not affected; review them separately (anonymous access, table permissions, site visibility).
Setting
| Location | Power Platform tenant settings (PowerShell) > disablePortalsCreationByNonAdminUsers |
| Default | false |
| Recommended | true |
Audit
- Install the
Microsoft.PowerApps.Administration.PowerShellmodule and runAdd-PowerAppsAccountas a Power Platform Administrator (no read-only role exposes tenant settings to PowerShell). - Run
(Get-TenantSettings).disablePortalsCreationByNonAdminUsers. - Fail if the value is
Falseor absent.
Remediation
- Run
Add-PowerAppsAccountas a Power Platform Administrator. - Run
Set-TenantSettings -RequestBody @{ disablePortalsCreationByNonAdminUsers = $true }. - Check again with
Get-TenantSettings. - Review existing sites in the Power Pages admin pages (Manage > Power Pages sites in the Power Platform admin center): visibility, anonymous access and table permissions.
Rollback
Run Set-TenantSettings -RequestBody @{ disablePortalsCreationByNonAdminUsers = $false }.
References
- Control site creation in a tenant Microsoft, vendor-doc, accessed 2026-10-24
- CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-6(10) | related |
| NIST SP 800-53 Rev. 55.1.1 | AC-22 | related |
| CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0 | MS.POWERPLATFORM.5.1v1 | equivalent |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1190 |
| MITRE ATT&CK | T1530 |
Related controls
- related
CB-M365-POWER-001Restrict production and sandbox environment creation to administrators
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
