Power Apps: Use Dataverse custom APIs in generative pages

🚨 The Signal: Power Apps generative pages can now call Dataverse custom APIs, enabling server-side business logic execution. This introduces new avenues for data manipulation and process automation, requiring careful security governance.

The Impact

Power Platform admins and security teams are affected by new risks from custom API calls, potentially leading to unauthorised data access or process manipulation.

  • Power Platform Admins: Must review and secure custom API access to prevent misuse.
  • Security Teams: Need to monitor API calls for anomalous behaviour and potential exploits.
  • Application Owners: Must ensure APIs are designed with least privilege and robust validation.
  • Compliance Officers: New data flows via APIs require updated risk assessments and attestations.

The Action

  1. Review existing Dataverse custom APIs for appropriate permissions and scope.
  2. Implement Data Loss Prevention (DLP) policies to restrict API connections and data exfiltration.
  3. Establish a robust API governance framework within Power Platform, including approval workflows.
  4. Regularly audit Power Apps and Dataverse API usage for suspicious activity via audit logs.
  5. Educate makers on secure API development and responsible use within generative pages.

Domain: Other · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges, Application Control · ISM: ISM-0445, ISM-0843, ISM-1175, ISM-1380, ISM-1490, ISM-1507, ISM-1508, ISM-1509, ISM-1544, ISM-1582, ISM-1647, ISM-1648, ISM-1650, ISM-1656, ISM-1657, ISM-1658, ISM-1659, ISM-1660, ISM-1686, ISM-1688, ISM-1689, ISM-1870, ISM-1871, ISM-1883, ISM-1897, ISM-1898