Applies to Product - Power Pages
What’s happening?
Invalid contact records were created in the Dataverse. This issue was observed between specific dates, and there are concerns regarding the method of their creation.
Reason:
The creation of these invalid records appears to be linked to open registration settings on the portal, which allowed unauthorized access. It is suspected that bot activity may have exploited this vulnerability, leading to the generation of spam contact records.
Resolution:
- Investigate the configuration of the portal to ensure that open registration is disabled to prevent unauthorized account creation.
- Restrict access to the portal so that only authenticated users can create records.
- Review the logs and audit trails to identify any suspicious activity related to the creation of contact records.
- If the issue persists, gather network logs and specific timestamps of when the invalid records were created to assist in further investigation.
- For future prevention, ensure that the portal is secured and that no pages have anonymous access, restricting them to admin roles only.