Power Automate - Export work queue items to CSV

🚨 The Signal: Power Automate now allows exporting work queue items to CSV. This increases data portability and potential for exfiltration, requiring enhanced data loss prevention (DLP) and access controls for sensitive process data.

The Impact

Power Automate administrators and security teams are affected by increased data exfiltration risk from work queues.

• Power Automate Admins: Increased risk of sensitive data exfiltration from work queues.
• Security Teams: New vector for data loss requires review of DLP policies and access controls.
• Compliance Officers: Potential for non-compliance if sensitive data is exported without proper controls.

The Action

1. Review existing Power Automate DLP policies to ensure work queue data is adequately protected.
2. Assess the sensitivity of data processed within Power Automate work queues.
3. Implement or refine access controls for users with permissions to export work queue items.
4. Monitor Power Automate audit logs for unusual export activity of work queue items.

Domain: Purview · Impact: medium · Workload: Microsoft Purview