{
  "id": "CB-M365-POWER-009",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-009",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-009.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-POWER-009.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-POWER-009",
    "title": "Disable sharing canvas apps with Everyone",
    "finding": {
      "title": "Makers can share canvas apps with Everyone",
      "description": "A maker can share an app, and the data its connections expose, with every account of the directory, guests included."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "power-platform",
      "power-apps",
      "sharing",
      "oversharing",
      "guests"
    ],
    "description": "The Power Platform tenant setting `powerPlatform.powerApps.disableShareWithEveryone` is `true`.\nMakers share canvas apps with named users or security groups; only Global Administrators,\nDynamics 365 Administrators and Power Platform Administrators can share an app with\n**Everyone**.\n",
    "rationale": "The **Everyone** principal contains every account that has signed in to the tenant, including\nB2B guests, and its membership can be neither viewed nor edited. Sharing an app with Everyone\nexposes its screens, and often the data behind its connections, far beyond the intended audience.\nMicrosoft disables the feature by default; enforcing the setting protects against a later change\nor a mistake.\n",
    "impact": "Makers who want broad distribution must use a security group (for example a dynamic group of\ninternal employees) or ask an administrator. Apps already shared with Everyone keep that sharing:\nreview them separately.\n",
    "setting": {
      "location": "Power Platform tenant settings (PowerShell) > powerPlatform.powerApps.disableShareWithEveryone",
      "default_value": "true",
      "recommended_value": "true"
    },
    "audit": {
      "manual": "1. Run `Add-PowerAppsAccount` as a Power Platform Administrator (module\n   `Microsoft.PowerApps.Administration.PowerShell`).\n2. Run `(Get-TenantSettings).powerPlatform.powerApps.disableShareWithEveryone`.\n3. To find apps already shared with Everyone, list role assignments per app, for example\n   `Get-AdminPowerApp | Get-AdminPowerAppRoleAssignment | Where-Object { $_.PrincipalType -eq\n   'Tenant' }`.\n4. Fail if the setting is `False`, or if apps shared with Everyone have no documented approval.\n"
    },
    "remediation": {
      "manual": "1. Run `Add-PowerAppsAccount` as a Power Platform Administrator.\n2. Run:\n   `$settings = Get-TenantSettings;\n   $settings.powerPlatform.powerApps.disableShareWithEveryone = $true;\n   Set-TenantSettings $settings`.\n3. For apps already shared with Everyone, replace the sharing with a security group (owner, or\n   administrator with `Remove-AdminPowerAppRoleAssignment` after adding the group).\n4. On managed environments, also configure **Sharing limits** (no sharing with security groups,\n   or a maximum number of viewers) for the environments that need it.\n",
      "rollback": "Set `disableShareWithEveryone` back to `$false` with the same commands.\n"
    },
    "references": [
      {
        "title": "Secure the default environment - Limit sharing with Everyone",
        "url": "https://learn.microsoft.com/power-platform/guidance/adoption/secure-default-environment",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Power Platform baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerplatform.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.POWERPLATFORM.6.1v1",
        "relation": "equivalent",
        "note": "SCuBA rates it SHOULD; our baseline profile requires it because the change has almost no impact."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(10)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1213"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}