Power Apps: Model-driven applications in Business Apps in Work IQ

🚨 The Signal: Power Apps model-driven apps are now accessible via natural language in Copilot Studio's Work IQ. This introduces AI-driven data interaction, enabling users to create, read, update, and delete records through chat, with explicit confirmation required for changes.

The Impact

All users interacting with Power Apps via Work IQ are affected, introducing risks related to data integrity, unauthorised access, and prompt injection.

• End Users: Risk of unintended data modification through natural language prompts.
• Admins: Need to review and update data access policies for AI-driven interfaces.
• Security Team: Increased surface area for prompt injection and data exfiltration risks.
• Data Owners: Potential for data integrity issues if AI interpretation is flawed.

The Action

1. Review existing Power Apps data loss prevention (DLP) policies for Work IQ integration.
2. Implement granular access controls for Work IQ access to model-driven apps.
3. Educate users on secure prompting practices and the confirmation step for data changes.
4. Monitor Work IQ audit logs for unusual data access or modification patterns.
5. Assess and update data classification and labelling policies for AI-accessed data.

Domain: Agentic-AI · Impact: high · Workload: Other