Power Pages Admin Security Auditor

Power Pages Admin Security Auditor

Use this skill when the user can act as an administrator and wants a supported, evidence-backed security review of a Power Pages site and its surrounding admin surfaces.

Resources

• scripts/playwright_admin_audit.cjs: crawl rendered pages with Playwright, optionally log in with admin credentials, and write JSON and Markdown findings for environment links, likely PII, and main-document header gaps.
• references/microsoft-learn.md: map crawl and admin findings to current Microsoft Learn guidance for Security workspace, admin center security, authentication, permissions, WAF, IP restrictions, auth key renewal, and SSL renewal.

Workflow

1. Treat credentials and session state as sensitive runtime inputs.

• Prefer environment variables such as POWER_PAGES_ADMIN_USERNAME and POWER_PAGES_ADMIN_PASSWORD.
• Prefer a saved Playwright storage state file for repeat runs.
• Never commit credentials, cookies, or storage state files.

1. Refresh the browser-auth pattern from Context7 before editing the login flow.

• Query /microsoft/playwright for storage state and role-based authentication setup.
• Prefer storageState reuse over repeated credential entry.
• If MFA or conditional access blocks scripted login, switch to a headed session, complete login interactively, save storage state, and rerun the audit with --storage-state-path.

1. Validate the config before touching the live site.

node .\scripts\playwright_admin_audit.cjs `
  --start-url https://contoso.powerpagesportals.com `
  --login-url https://contoso.powerpagesportals.com/SignIn `
  --username-selector "input[type='email']" `
  --password-selector "input[type='password']" `
  --submit-selector "button[type='submit']" `
  --post-login-url "**/profile" `
  --output-prefix .\artifacts\contoso-admin-audit `
  --dry-run

1. Run the authenticated audit.

node .\scripts\playwright_admin_audit.cjs `
  --start-url https://contoso.powerpagesportals.com `
  --storage-state-path .\artifacts\contoso-admin.json `
  --allow-host contoso-uat.powerappsportals.com `
  --max-pages 30 `
  --output-prefix .\artifacts\contoso-admin-audit

Or let the script sign in directly:

$env:POWER_PAGES_ADMIN_USERNAME="admin@contoso.com"
$env:POWER_PAGES_ADMIN_PASSWORD="use-a-secure-runtime-secret"
node .\scripts\playwright_admin_audit.cjs `
  --start-url https://contoso.powerpagesportals.com `
  --login-url https://contoso.powerpagesportals.com/SignIn `
  --username-selector "input[type='email']" `
  --password-selector "input[type='password']" `
  --submit-selector "button[type='submit']" `
  --post-login-selector "[data-testid='profile-menu']" `
  --output-prefix .\artifacts\contoso-admin-audit

1. Review admin-only controls with Microsoft Learn-backed checks from references/microsoft-learn.md.

• Security workspace: deep scan, include authenticated pages when applicable, page permissions, table permissions, web roles, identity providers, advanced settings, WAF.
• Power Platform admin center: anonymous Dataverse access, WAF disabled, external auth enabled, auth key expiry, SSL certificate expiry, deep scan and quick scan posture, authentication providers, sites with integrations.
• Environment restrictions: site visibility, IP restrictions, Azure Front Door and WAF posture for non-public environments.

1. Correlate rendered-page findings with admin evidence.

• Treat PII findings as likely exposure until confirmed.
• Treat environment links as important when authenticated or public pages reference dev, test, qa, uat, stage, sandbox, or production hosts.
• Treat missing or weak headers as hardening findings, then map each one to the supported Power Pages setting or admin control.

Report Structure

Use this default structure unless the user asks for a different format:

# Power Pages Admin Security Audit

## Scope
- Start URLs
- Environments reviewed
- Auth mode

## Automated Authenticated Findings
- Pages visited
- Login path used
- High signal findings

## Environment Links
- Source page
- Target URL
- Guessed environment
- Why it matters

## Likely PII Exposure
- PII type
- Page URL
- Evidence snippet
- Confidence and false-positive notes

## Header And Browser Boundary Findings
- Missing or weak headers
- Open CORS findings
- Redirect or auth anomalies

## Admin Surface Review
- Security workspace deep scan and authenticated coverage
- Table permissions and anonymous access
- Page permissions and web roles
- Identity providers and external authentication posture
- WAF, IP restrictions, auth key expiry, SSL certificate expiry

## Next Actions
- Immediate containment
- Configuration fixes
- Retest steps

Guardrails

• Stay inside explicit user-approved tenants, hosts, and environments.
• Do not echo raw credentials, cookies, tokens, or storage state in chat or in committed files.
• Delete temporary storage state after the audit unless the user explicitly wants it preserved.
• Do not perform destructive changes in maker, portal management, or admin center unless the user asks for remediation.
• Prefer Microsoft Learn-backed remediation over generic portal advice when Power Pages exposes a supported control.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: RyanMakesAndBreaksStuff
• Source: RyanMakesAndBreaksStuff/Custom-Codex-Claude-Plugins-and-Skills
• License: MIT

Install and usage instructions live in the source repository linked above.