Power Apps Security Considerations

    The importance of security cannot be understated especially when working with apps that contain business critical and confidential information. Ensuring the security of your data while being able to utilize it in a robust application can provide near limitless value to your organization. The threat of being hacked is present at all times and will continue to grow as time goes on. Microsoft and the Power Platform provide many security mechanisms by default, but in order to take full advantage and handle any missing pieces these areas must be considered:

·    Environments: By default, all users will be added to the Environment Maker role of the default environment in Power Apps. This can allow users to obtain information and permissions that were inadvertent.  Consider creating separate environments and assigning roles only as necessary to ensure no additional permissions are assigned to people that should not have that access. Using the Zero Trust principles you can make better decisions in how to assign roles, privileges, and remediation techniques without sacrificing functionality.

·    Using Explicit Shared Connections: This connection type requires that end users authenticate to the back-end server with their credentials. Compared to implicit shared connections which allow all shared users to access the source with the hardcoded credentials of the developer. This is a very poor and insecure method of allowing access to what could be sensitive information and should be avoided at all costs.

·    Data Loss Protection (DLP) Policies: These policies include rules that prevent connectors from communicating with each other. Policies can be assigned at different scopes and are inherited by lower levels; Note that setting policies at different scopes requires different levels of permissions. Connectors can be grouped in three groups: Business, Non-Business, and Blocked. Any data in business or non-business groups cannot be shared across groups, blocked connectors cannot be used at all. DLP policies can be layered to provide more granular control and it is important to note that the most restrictive layer will always take precedence

·    Security Connectors: In the predefined list of connectors supported by Power Apps there are several that connect to security tools for monitoring malicious activity. Consider looking through the connectors and choosing one that best meets the needs of your application. Microsoft Defender is offered as a premium connector that provides several actions that can be taken to monitor and act on suspicious activity. Custom connectors can also be built to integrate third party security solutions that may already be in use in your organization.

    While these considerations merely scratch the surface of measures that must be taken to ensure security in your app, they are essential. Security plans should be well thought out and applied in the most restrictive manner without interfering with functionality. As always, we here at Networking Planet are here to help with any security assessments or implementations that you may be interested in. For any inquiries, please submit a support request here.