Power Platform Security Assessment: How Mature Is Your Tenant?

Blog series: Power Platform Security & Zero Trust — Part 4 of 4

This is the fourth and final blog in a four-part series on Power Platform security and Zero Trust. The previous blogs covered why default settings are a security risk, how to build a governance framework, and how to translate that framework into technical configuration. This blog introduces a PowerShell script that automatically assesses the security maturity of your Power Platform tenant — and shows you where to start improving.

You know what you should have configured. But how far have you actually come?

The previous three blogs laid the foundation: why Power Platform must be treated as an enterprise workload, how to set up a governance framework, and which technical configurations go along with it. But defining governance and demonstrating governance are two different things.

Does your tenant meet the security and configuration standards we have described? Where are the gaps? And what do you tackle first? To answer those questions, I built — with the help of GitHub Copilot — a PowerShell script that automatically evaluates your tenant.

What does the script do?

The script connects to your Power Platform tenant and automatically checks 10 security domains based on the Zero Trust framework, Microsoft best practices, and CISA guidelines. All you need is a login and an account with the right permissions — a Power Platform Administrator or Global Administrator role.

There are no external dependencies, no additional licenses, and no extra tooling required. The necessary PowerShell modules are installed automatically if not already present. Run the script, log in, and get a complete picture of the state of your tenant within minutes.

The script was not built to impress — it was built to be useful. An administrator running it for the first time gets a concrete view of where their tenant stands within minutes.

The 10 domains

Each domain translates into a set of concrete checks. Every check returns a result: Pass, Warn, Fail, or Info — with an impact classification (Critical / High / Medium / Low) and a direct recommendation.

Domains 1 and 7 are specifically relevant for AI governance: domain 1 evaluates the Copilot and AI settings at tenant and environment level, while domain 7 assesses the Managed Environments controls — including generative AI features.

How do you use the script?

Usage has been kept deliberately simple. No complex configuration is needed — just a PowerShell session and an account with the right permissions.

# Basic execution (interactive login)
.\Invoke-PowerPlatformSecurityAssessment.ps1
# With HTML report output
.\Invoke-PowerPlatformSecurityAssessment.ps1 -ExportHTML
# HTML report to a specific folder
.\Invoke-PowerPlatformSecurityAssessment.ps1 -ExportHTML -OutputPath "C:\Reports"
# Filter failed checks only
$PPAssessmentResults | Where-Object { $_.Status -eq "Fail" } | Select CheckId, Title, Recommendation

After execution, the script generates an interactive HTML report with an overall security score, a maturity level, and filterable findings per domain. The report is immediately usable — for yourself as an administrator, as input for an improvement plan, or as reporting for management or audit.

The script is available via GitHub. The link will be added here once the repository is published.

Built with GitHub Copilot

The script was developed with GitHub Copilot as a co-pilot. Not as a replacement for domain knowledge, but as an accelerator: the structure, the checks, and the recommendations are substantively grounded in the Zero Trust framework and Microsoft best practices. Copilot helped translate that knowledge into working PowerShell code.

The result is a script that is practical to run and delivers immediate value — without requiring you to be a security engineer to understand or use it.

From baseline to improvement plan

An assessment without follow-up is a report that ends up in a drawer. Translate the findings of the script into a concrete improvement plan in three steps:

Re-run the script periodically to measure progress. An assessment is a snapshot — Zero Trust requires continuous verification. Today’s score is your baseline. The score in three months shows whether your governance is actually improving.

What if something goes wrong anyway?

This series has focused on prevention. But Zero Trust also assumes breach — so it is worth briefly addressing what to do when something does go wrong in your Power Platform environment.

The first step is detection. Power Platform audit logs, surfaced through the Microsoft Purview compliance portal or Microsoft Sentinel, are your primary signal. Look for unexpected connector usage, flows triggered from unusual accounts, agents accessing data sources they should not reach, or a sudden spike in environment activity.

Once an incident is identified, the response steps are:

• Isolate: Disable the affected app, flow, or agent immediately via the Power Platform Admin Center. If necessary, restrict access to the environment entirely using the IP Firewall in Managed Environments.
• Revoke: Remove the Environment Maker role from the affected account and revoke any active connections or service principal permissions tied to the incident.
• Investigate: Use audit logs and the CoE Starter Kit to trace what the resource accessed, what data it processed, and whether any data left the environment via a connector.
• Remediate: Fix the root cause — whether that is a misconfigured DLP policy, an overprivileged account, or a connector that should not have been available. Re-run the assessment script to verify the gap is closed.
• Document: Record the incident, the timeline, and the remediation steps. This is essential for audit accountability and for improving your governance posture going forward.

Good governance reduces the likelihood of an incident. Audit logs, DLP, and segmentation reduce the blast radius when one occurs. Both matter.

Also worth mentioning: Power Platform Inventory Report by Daniel Laskewitz

Besides the assessment script in this blog, there is another valuable tool for Power Platform administrators: the Power Platform Inventory Report by Daniel Laskewitz, available on GitHub.

Where the script in this blog runs from PowerShell and focuses on security maturity, Daniel’s solution works from GitHub Copilot in VS Code and uses the Power Platform Inventory API combined with the pac CLI. It generates an interactive HTML report with environment inventory, DLP policies, governance analysis, and prioritized recommendations — including exact pac commands to fix each issue directly.

When to use which?

Both tools complement rather than replace each other. The assessment script gives you a security maturity score based on Zero Trust principles — ideal for a governance audit or as input for an improvement plan. The Inventory Report by Laskewitz gives you a complete overview of what lives in your tenant — environments, resources, DLP coverage — and is particularly strong at quickly mapping the breadth of your Power Platform estate.

A logical approach: use the Inventory Report as a starting point to understand what is running in your tenant, and the assessment script to evaluate how secure and mature that configuration actually is.

Closing the series

Power Platform is not an exception to your security policy. It is an integral part of your application ecosystem — with apps, flows, and AI agents that carry the same risks, governance requirements, and responsibilities as any other enterprise platform.

This series has covered four steps:

• Blog 1: Why default settings are a security risk — for apps, flows, and AI agents
• Blog 2: The governance framework: environments, identity, DLP, and AI governance
• Blog 3: Technical configuration: from model to implementation, including Copilot Studio controls
• Blog 4: Assessment: measure where you stand and address the gaps systematically

The next step is yours. Run the assessment, know your baseline, and work through the findings. Zero Trust is not a destination — it is a continuous process of improvement and verification.