docs(audit): Power Platform pattern catalog (closes #336)#370
Merged
Conversation
Thirteenth domain audit under v3.4.0 umbrella (#326). Resolves spike #336. docs/audits/power-platform.md surfaces an inverse-of-typical coverage finding: TOO MUCH duplicate Power BI coverage (26 existing checks across PBI-* + POWERBI-* with 11 confirmed duplicate pairs) and ZERO coverage of the broader Power Platform (Power Apps, Power Automate, Dataverse, Copilot Studio, tenant isolation, environment hygiene, DLP). Catalogs 23 unique patterns across 6 sub-domains (tenant isolation, environment hygiene, DLP policy coverage, sharing controls, Copilot governance, anti-patterns). Headline outcomes: - 11 confirmed duplicate pairs PBI-* ↔ POWERBI-* (resolves the consolidation chore originally flagged in #333) - 3 PBI-TENANT-* meta-checks that overlap further - 17 gap CheckIDs (the largest cluster: 5 in DLP policy coverage, including the HTTP connector restriction which is the workhorse of Power Platform exfil prevention) - Default environment lockdown is named the #1 governance recommendation - 4 cross-spike with #335 (Copilot grounding + sensitivity labels) - Proposes fourth canonical data file: data/power-platform-connectors.json for recommended connector classifications. Joins role-tiers.json, microsoft-first-party- appids.json, transport-rule-actions.json — pattern emerging across audits worth coordinating as v3.5 release theme. Threat-pattern map covers: - Citizen-developer data exfil via flow (compromised user emails CSV to attacker mailbox) - Cross-tenant data flow via guest maker (no tenant isolation) - Default-environment proliferation (everyone is auto-Maker) - Personal-cloud connector to enterprise data (cross-classification combination) - Custom HTTP connector → arbitrary egress - Public Power BI report leak (already covered ✅) - Copilot grounding leak across sensitivity classes - Copilot Studio bot exfil DETECTION-METHOD FIRST: this is the first audit where detection lives in the Power Platform admin PowerShell module (Microsoft.PowerApps.Administration.PowerShell), separate from Graph AND from Exchange Online PowerShell. Auth uses different consent flow than Graph (explicit Power Platform admin role + tenant-level consent in PP admin center). Appendix documents 8 edge cases including connector classification list dynamism, environment-count scaling, PBI/POWERBI namespace duplication mechanics, and Copilot governance emerging surface. Same template as #327, #328, #329, #330, #331, #332, #333, #334, #337, #338, #339, #340. Closes #336 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Content enrichment populationOverall (1105 checks): rationale 26.3% (291/1105) • impact 26.3% (291/1105) • references 26.3% (291/1105)
Informational only — does not gate the build. The hard release-gate for Critical/High enrichment lives in #281 (v3.2.0). |
Framework mapping count delta
Result: ✓ PASS — no framework mapping regressions detected. |
This was referenced Apr 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves spike #336. Thirteenth domain audit under v3.4.0 umbrella (#326). Ships
docs/audits/power-platform.md.Resolves the PBI/POWERBI duplication chore from #333.
The headline finding
Inverse of typical: too much duplicate Power BI coverage and zero coverage of the broader Power Platform.
11 confirmed PBI/POWERBI duplicate pairs
PBI-*POWERBI-*PBI-AUTH-001POWERBI-AUTH-001PBI-API-001POWERBI-AUTH-002PBI-PROFILE-001POWERBI-AUTH-003PBI-GUEST-001POWERBI-GUEST-001PBI-INVITE-001POWERBI-GUEST-002PBI-CONTENT-001POWERBI-GUEST-003PBI-LABELS-001POWERBI-INFOPROT-001PBI-PUBLISH-001POWERBI-SHARING-001PBI-SCRIPT-001POWERBI-SHARING-002PBI-LINK-001POWERBI-SHARING-003PBI-SHARING-001POWERBI-SHARING-004Plus 3
PBI-TENANT-*meta-checks that overlap further.Coverage matrix
Threat-pattern map highlights
Fourth canonical data file proposed
data/power-platform-connectors.json— curated reference of Power Platform connectors with recommended classifications (Business / Non-Business / Blocked).This is now the fourth canonical reference data file proposed across the audit work:
data/role-tiers.json(spike: research privileged access patterns (PIM, role assignments, emergency access) #328)data/microsoft-first-party-appids.json(data: introduce data/microsoft-first-party-appids.json (canonical Microsoft owner-tenant + AppId allowlist) #361)data/transport-rule-actions.json(proposed spike: research mail flow patterns (transport rules, connectors, forwarding, inbox rule audit) #339)data/power-platform-connectors.json(this PR)Worth coordinating as a v3.5 release theme: "canonical reference data layer for cross-consumer M365 governance."
Detection-method first: Power Platform admin PowerShell
This is the first audit where detection lives in
Microsoft.PowerApps.Administration.PowerShell, separate from both Graph and Exchange Online PowerShell. Auth uses a different consent flow than Graph (explicit Power Platform admin role + tenant-level consent in the PP admin center).Power BI side uses yet another module (
MicrosoftPowerBIMgmt).Files
docs/audits/power-platform.md— 328 linesCHANGELOG.md—[Unreleased]/ Documentation entryTest plan
tests/registry-integrity.Tests.ps1+tests/framework-definitions.Tests.ps1— 268/268 pass locallyOut of scope
Progress on v3.4.0 audit umbrella
13 of 14 domain audits done. Identity stack done. Collaboration triad done. Mail flow + Intune + MDCA done. Power Platform now done.
Last remaining: #335 Purview — DLP + sensitivity labels + retention. Largest scope, most distinct from prior audits, and the cross-spike target for several open consolidations (#337 sensitivity-label site protection, #340 Teams sensitivity labels, #336 Copilot grounding labels).
🤖 Generated with Claude Code