{
  "id": "CB-M365-POWER-008",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-008",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-008.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-008.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-008",
    "title": "Restrict Power Pages site creation to administrators",
    "finding": {
      "title": "Any maker can create Power Pages sites",
      "description": "Non-administrators can create public-facing websites connected to Dataverse data, with their own access and anonymous settings."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "power-platform",
      "power-pages",
      "public-websites",
      "governance"
    ],
    "description": "The Power Platform tenant setting `disablePortalsCreationByNonAdminUsers` is `true`. Only Dynamics\n365 Administrators and Power Platform Administrators can create Power Pages sites; makers request\na site from the platform team, which reviews its exposure, authentication and table permissions.\n",
    "rationale": "A Power Pages site is an internet-facing web application on top of Dataverse. A maker who\nmisconfigures table permissions or anonymous access can expose business records to the whole\ninternet, which has happened repeatedly in real incidents. Restricting site creation ensures each\npublic site is reviewed before it exists.\n",
    "impact": "Makers who try to create a site get a permission error and must go through the platform team.\nExisting sites are not affected; review them separately (anonymous access, table permissions,\nsite visibility).\n",
    "notes": "The setting has no switch in the Power Platform admin center and is managed with PowerShell or\nthe Power Platform API.\n",
    "setting": {
      "location": "Power Platform tenant settings (PowerShell) > disablePortalsCreationByNonAdminUsers",
      "default_value": "false",
      "recommended_value": "true"
    },
    "audit": {
      "manual": "1. Install the `Microsoft.PowerApps.Administration.PowerShell` module and run\n   `Add-PowerAppsAccount` as a Power Platform Administrator (no read-only role exposes tenant\n   settings to PowerShell).\n2. Run `(Get-TenantSettings).disablePortalsCreationByNonAdminUsers`.\n3. Fail if the value is `False` or absent.\n"
    },
    "remediation": {
      "manual": "1. Run `Add-PowerAppsAccount` as a Power Platform Administrator.\n2. Run `Set-TenantSettings -RequestBody @{ disablePortalsCreationByNonAdminUsers = $true }`.\n3. Check again with `Get-TenantSettings`.\n4. Review existing sites in the Power Pages admin pages (**Manage** > **Power Pages sites** in\n   the Power Platform admin center): visibility, anonymous access and table permissions.\n",
      "rollback": "Run `Set-TenantSettings -RequestBody @{ disablePortalsCreationByNonAdminUsers = $false }`.\n"
    },
    "references": [
      {
        "title": "Control site creation in a tenant",
        "url": "https://learn.microsoft.com/power-pages/admin/control-site-creation",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power Platform baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerplatform.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERPLATFORM.5.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(10)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-22",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1190"
      },
      {
        "framework": "mitre-attack",
        "id": "T1530"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}