Dynamics 365 Supply Chain Management: Procurement - Manage supplier relationships with Supplier Engagement

🚨 The Signal: A new Power Apps-based Supplier Engagement application and Power Pages supplier portal integrate with Dynamics 365. This introduces new external-facing collaboration points for supplier onboarding, RFQs, purchase orders, and invoices, expanding the attack surface.

The Impact

Procurement and IT teams are affected by new external portals, increasing the risk of data exposure and unauthorised access if not properly secured.

  • Procurement teams: Increased risk of data exposure through new external portals.
  • IT Security teams: New applications require security configuration and monitoring.
  • Suppliers: Potential for phishing or credential compromise if portal security is weak.
  • Compliance teams: New external interfaces require privacy and data handling reviews.

The Action

  1. Review Power Platform Data Loss Prevention (DLP) policies for Dynamics 365 environments.
  2. Implement robust authentication and authorisation for the Power Pages supplier portal.
  3. Conduct security assessments of the Supplier Engagement app and Power Pages portal configurations.
  4. Establish monitoring and alerting for unusual activity on the new supplier-facing interfaces.
  5. Update incident response plans to include potential breaches via these new applications.

Domain: Other · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898