Power Pages - Create and delete websites using Power Platform CLI

🚨 The Signal: Power Platform CLI now allows creating and deleting Power Pages websites via command line. This introduces automation capabilities for site lifecycle management, increasing the attack surface if not properly governed, and impacting change control processes.

The Impact

Admins and Security Teams are affected by increased risk of unauthorized site changes and potential data exposure.

• Security Teams: Increased attack surface from unmanaged Power Pages sites.
• Admins: Risk of unauthorized site creation or deletion outside of change control.
• Developers: New automation capabilities require secure credential management.
• Auditors: Challenges in maintaining an accurate inventory of Power Pages assets.

The Action

1. Review Power Platform environment security roles and permissions for pac CLI usage.
2. Implement Conditional Access policies for Power Platform CLI access.
3. Establish CI/CD pipeline security best practices for Power Pages deployments.
4. Monitor Power Platform audit logs for pac pages create-site and delete-site activities.
5. Update incident response plans to include Power Pages site compromise scenarios.

Domain: Other · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898