MS.PowerPlatform.4.1v1 - Content Security Policy

[msftkru]

💡 Summary

What is the work, as a high-level summary?

The Content Security Policy is only applicable to the use of Dataverse with Power Apps. Suggest adding a note that 4.1 is only applicable to Environments with Dataverse.

Why does this work belong in this project?

This would be useful because... It would ease frustration for agencies who are trying to apply this configuration to environments which do not use Dataverse.

Please provide details for implementation, such as:

Add a note or wording to call out this only applies to environments with Dataverse.

How do we know when this work is done?

When 4.1 is updated in the baseline.

[buidav]

Thanks for opening an issue in this. The MS Learn documentation for Content Security Policy doesn't mention that Dataverse is an explicit requirement.
However, there is the implicit requirement as the page is under the 'Configure Security for Dataverse' MS Learn section.

Will add the note but, could you elaborate on what frustrations someone would face when trying to apply the baseline policy to Power Platform environment without Dataverse? Are the sliders not visible in that case or is there a warning/exception message that appears?

[msftkru]

Yes, CSP is a sub heading under "Configure Security for Dataverse", I'm working with the MSFT Docs to team to add a note that this policy only applies to Environments with Dataverse. With the SCuBA policy linking directly to the CSP doc agencies may not notice that it falls under the Dataverse section.

An environment without Dataverse will not have a Settings option so step 3 onwards would not apply to that Environment. Given this policy is marked as a SHALL, it has already caused some agencies confusion as to why they do not see that option.

Thanks,
Rhett

[buidav]

Yes, CSP is a sub heading under "Configure Security for Dataverse", I'm working with the MSFT Docs to team to add a note that this policy only applies to Environments with Dataverse. With the SCuBA policy linking directly to the CSP doc agencies may not notice that it falls under the Dataverse section.

An environment without Dataverse will not have a Settings option so step 3 onwards would not apply to that Environment. Given this policy is marked as a SHALL, it has already caused some agencies confusion as to why they do not see that option.

Thanks, Rhett

Thanks for response and details!
Note that Power Platform 4.1 is a SHALL baseline policy but NOT required by BOD 25-01 as a check can't be automated and thus is not listed on the SHALL policies required by 25-01.