• Open the Power Platform Admin Center at https://admin.powerplatform.microsoft.com and navigate to Data policies under Resources.
• Click + New policy and name it something specific like “Tenant Baseline DLP Policy”.
• In the Connectors tab, sort built-in connectors into three groups:
  • Business: Internal systems (SharePoint, SQL Server, Dataverse, OneDrive for Business)
  • Non-Business: External consumer services (Gmail, Dropbox, Twitter)
  • Blocked: High-risk connectors (HTTP, unapproved third-party APIs)
• • For the SQL Server connector, click Configure then Connector actions to restrict operations. Allow Read but block Insert, Update, and Delete to enforce read-only access.
  • For HTTP, HTTP with Azure AD, SQL, Azure Blob Storage, use Endpoint filtering to whitelist specific domains or IP addresses (like https://api.yourcompany.com) and block everything else.
  • In the Custom connectors tab, set default behavior to Blocked. Only allow approved endpoints using pattern matching (such as .yourcompany.com).
  • In the Scope tab, decide whether the policy applies across the entire tenant or excludes specific environments (you might exclude Dev/Test if you’re using separate policies there).
  • Set the Default group for new connectors to Blocked rather than Non-Business. This prevents unknown connectors from being used automatically.
  • Review and Save the policy. It takes effect immediately for all scoped environments.
  • For Dev/Test environments, create a separate DLP policy with stricter rules (block HTTP entirely, for example) and apply it only to those environments.
  • Monitor violations in the Power Platform Admin Center under Data policies then Policy violations, or integrate with Microsoft Defender for Cloud Apps for advanced threat detection and audit logging.

The most restrictive policy applies when multiple policies are assigned. Environment-level policies cannot override tenant-level ones.

1. Enable MFA via Conditional Access

• Go to Microsoft Entra Admin Center → Protection → Conditional Access.
• Create a new policy:
  • Name: “Require MFA for Power Platform & SharePoint”
  • Users: Select relevant users or groups
  • Cloud apps: Include Power Apps, Power Automate, SharePoint Online
  • Conditions: Apply as needed (device state, location)
  • Access controls → Grant: Require multi-factor authentication
• Enable the policy to enforce MFA at sign-in.

2. Configure PIM for just-in-time admin access

• In Microsoft Entra ID, go to Privileged Identity Management (PIM).
• Assign users as eligible for admin roles (Global Administrator, SharePoint Administrator).
• Configure role settings:
  • Assignment Type: Eligible
  • Duration: Set time limits (max 8 hours)
  • MFA: Require during activation
  • Approval: Enable and specify approvers
  • Justification: Require business reason
• Users must activate roles via PIM when needed, fulfilling MFA and approval requirements.

{
"schema": "https://developer.microsoft.com/json-schemas/sp/sites/provisioning-schema.json",
"templateName": "Contoso Site Template",
"description": "Standard site for Contoso teams with document library and news",
"siteDesignId": "6142d2a0-63a5-4ba0-aede-d9fefca2c767",
"webUrl": "team",
"title": "Team Site",
"shareByEmailEnabled": false,
"siteScripts": [
{
"title": "Add Document Library",
"description": "Adds a standard document library",
"content": "function() { var ctx = SP.ClientContext.get_current(); var web = ctx.get_web(); var listInfo = new SP.ListCreationInformation(); listInfo.set_title('Documents'); listInfo.set_templateType(SP.ListTemplateType.documentLibrary); web.get_lists().add(listInfo); ctx.load(listInfo); ctx.executeQueryAsync(); }"
}
],
"lists": [
{
"title": "Shared Documents",
"url": "Shared Documents",
"template": 101,
"sublists": [],
"permissions": {
"breakRoleInheritance": true,
"copyRoleAssignments": false,
"roleAssignments": [
{
"principal": "Contoso Members",
"roleDefinition": "Edit"
},
{
"principal": "Contoso Owners",
"roleDefinition": "Full Control"
}
]
}
}
],
"theme": "Contoso Theme",
"homePage": {
"sections": [
{
"columns": [
{
"colSize": 12,
"controls": [
{
"id": "1dafb215-9a52-47ed-95cb-74391994955b",
"data": {
"title": "Welcome",
"description": "Welcome to the team site"
}
}
]
}
]
}
]
}
}