Power Platform Community Forum Thread Details

I have an App that uses an implicitly shared connection with SQL Server (Azure).
This App is isolated in an environment where only the development team has access.
Are there any known loopholes that allow end users to directly access data in the Bank? Or somehow access the data by creating your own Apps in another environment? I don't know... the question is is my data at risk? The implicit connection uses login with a SQL user created just for this.

Categories:

Building Power Apps

@AlamBique1

With an implicit connection, the loophole is that an end user can create a new app or flow in the same environment, and access the tables that are accessible through the connection.

It's not possible to access the data from another environment because connections are scoped to environments and therefore isolated from each other.

The workaround for this is to not use an implicit connection - ie, to use AzureAD authentication.

If you must use an implicit connection, you should enable the experimental 'Secure implicit connections' setting. This closes the loophole that I mention above.

https://learn.microsoft.com/en-us/power-apps/maker/canvas-apps/connections-list#secure-implicit-connections-experimental