Disable sharing canvas apps with Everyone

Description

The Power Platform tenant setting powerPlatform.powerApps.disableShareWithEveryone is true. Makers share canvas apps with named users or security groups; only Global Administrators, Dynamics 365 Administrators and Power Platform Administrators can share an app with Everyone.

Rationale

The Everyone principal contains every account that has signed in to the tenant, including B2B guests, and its membership can be neither viewed nor edited. Sharing an app with Everyone exposes its screens, and often the data behind its connections, far beyond the intended audience. Microsoft disables the feature by default; enforcing the setting protects against a later change or a mistake.

Impact

Makers who want broad distribution must use a security group (for example a dynamic group of internal employees) or ask an administrator. Apps already shared with Everyone keep that sharing: review them separately.

Setting

Audit

1. Run Add-PowerAppsAccount as a Power Platform Administrator (module Microsoft.PowerApps.Administration.PowerShell).
2. Run (Get-TenantSettings).powerPlatform.powerApps.disableShareWithEveryone.
3. To find apps already shared with Everyone, list role assignments per app, for example Get-AdminPowerApp | Get-AdminPowerAppRoleAssignment | Where-Object { $_.PrincipalType -eq 'Tenant' }.
4. Fail if the setting is False, or if apps shared with Everyone have no documented approval.

Remediation

1. Run Add-PowerAppsAccount as a Power Platform Administrator.
2. Run: $settings = Get-TenantSettings; $settings.powerPlatform.powerApps.disableShareWithEveryone = $true; Set-TenantSettings $settings.
3. For apps already shared with Everyone, replace the sharing with a security group (owner, or administrator with Remove-AdminPowerAppRoleAssignment after adding the group).
4. On managed environments, also configure Sharing limits (no sharing with security groups, or a maximum number of viewers) for the environments that need it.

Rollback

Set disableShareWithEveryone back to $false with the same commands.

References

• Secure the default environment - Limit sharing with Everyone Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle