An HTTP-triggered flow anyone with the URL can run

HTTP-triggered flow can be run by anyone with the URL.

The flow's trigger accepts anyone with the URL, no identity check, so a leaked link lets anyone drive whatever the flow does in Dataverse. Power Automate now defaults new flows to tenant-restricted.

Export the solution and search the flow definition JSON for request triggers, then read the authentication setting on each. Older flows predate the tenant-restricted default, so age is a good filter for where to look first.

Restrict the trigger to your tenant or named users, and regenerate the signature key so old URLs stop working.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for AC.L1-3.1.1 (Level 1: limit system access to authorized users, processes and devices), for the Dataverse system in your assessment scope. 3.1.1 asks which users and processes are authorized. A trigger that accepts anyone holding the URL has answered that with everyone, and a URL is not a secret in any managed sense.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A credential stored in a plugin step's unsecure configuration
• A password or API key written into a Power Automate flow
• A webhook or service endpoint using plaintext HTTP
• A webhook registered without any authentication