Power Community

Power Community

Announcing public preview of Content Security Policy for Power Apps

Headshot of article author Sid Gundavarapu

We’re excited to announce the public preview of Content Security Policy for Power Apps!

Power Apps has had Content Security Policy (CSP) support for model-driven apps since the beginning of the year, which was configured by running script as a System Administrator.

With these new capabilities, you can now control the CSP header for model-driven as well as canvas apps in the environment in Power Platform Admin Center. CSP can be configured in both enforced and report-only mode.

Configuration in Power Platform Admin Center

CSP can be configured using the Content security policy settings under the Privacy + Security section of an environment in Power Platform Admin Center. Turning enforcement on will provide protection against clickjacking attacks for apps in that environment. CSP is configured independently for model-driven and canvas apps, except for reporting which applies to both.

Content security policy setting in Power Platform Admin Center

Reporting and enforcement are disabled by default, and we recommend you turn on enforcement in your production environments only after testing your apps in a sandbox environment with CSP turned on to ensure any intended functionality isn’t blocked due to this change. We also recommend turning reporting-only mode on in production before enforcement to catch any lingering issues before enforcement is enabled.

CSP support for canvas apps

Model-driven apps have had the ability to send default and custom CSP for some time. With this update we’ll support CSP for canvas apps as well. The default and customizable pieces of the CSP header are the same for both model-driven and canvas, but they are configured independently, allowing you to perform a gradual CSP rollout.

Violation reporting

As part of the CSP settings, you can also enable reporting and provide a custom reporting endpoint to receive any content security policy violation reports. This capability helps preview what violations would be blocked before turning it on completely. Refer to the Content Security Policy documentation for details on building reporting endpoint.

Enable CSP reporting setting in Power Platform Admin Center

Please review the documentation for more details and as always, we would love to hear from you on how we could keep improving this feature. Please leave your feedback and comments on this post.

- Advertisement -spot_img


Please enter your comment!
Please enter your name here

- Advertisement -spot_img
- Advertisement - Advertisement

Latest News

What’s New in the September Release of Power BI Report Server

This release introduces Power BI Report Server (PBIRS) for SQL Server 2022. We continue to innovate, create, and design...

More Articles Like This

- Advertisement -spot_img