Power Platform Security Assessment

These steps are optional. The assessment runs either way — if you don’t grant the access below, the related controls simply report “Not Assessed”. Grant it and baref00t assesses them too.

• Power Platform management-app registration (optional)

  Optional

  Power Platform governance lives outside Microsoft Graph, and — unlike our read-only Graph scopes — Microsoft does not allow this registration to be scoped to read-only: the registered app gains Power Platform Administrator capability tenant-wide. Because it is not read-only, it is entirely optional. Register it and baref00t reads your environment + DLP configuration; skip it and the Power Platform-specific controls report "Not Assessed" — the Entra/M365 governance controls still run either way. Remove any time with Remove-PowerAppManagementApp.

  If you choose to enable full Power Platform coverage, run the following in PowerShell as a Global Admin or Power Platform Admin. This is optional — the assessment runs without it.

  Install-Module Microsoft.PowerApps.Administration.PowerShell -Scope CurrentUser
  Add-PowerAppsAccount
  New-PowerAppManagementApp `
    -ApplicationId 89f14c09-7eff-43ef-8f57-b793a0ae60cd