A Power Pages site running with demo mode enabled
What it is
Power Pages demo mode is on, so login codes render on screen.
Why it matters
Demo mode prints password reset and second-factor codes onto the page instead of sending them to the account's email or phone. Anyone who can start a reset for an account can read the code that reset was meant to deliver privately, so the second factor stops being a second factor.
Pathix reports this from an explicitly configured site setting and never from a platform default, because the default for this setting is off: somebody turned it on. Microsoft documents it as development-only. Nothing in a scan says whether an environment is production, a sandbox or a trial, so Pathix states that demo mode is on and leaves that judgment to you. A demonstration site holding no real accounts is a reasonable place for it. Anywhere real people sign in is not.
Find it yourself
Portal Management, Site Settings, look for Authentication/Registration/IsDemoMode. Verify by starting a password reset from a private browser window with no session and confirming the code is delivered to the account rather than displayed on the page.
How to fix it
Set Authentication/Registration/IsDemoMode to false and restart the site. Treat any credential reset or second factor enrolled while it was on as needing to be reissued.
Related controls
These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.
CMMC relevance
This condition produces evidence for IA.L2-3.5.2 (Level 2: authenticate or verify the identities of users, processes and devices before allowing access), for the Dataverse system in your assessment scope. 3.5.2 is about authentication actually authenticating. A setting that prints the reset code and the second-factor code onto the page defeats the control at the point it is exercised, and it is a configured value rather than a default, so the question for an assessor is who turned it on and whether real accounts existed while it was.
Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.
Pathix checks this across every environment you scan, along with 71 other conditions. Self-hosted in your own Azure, read-only, metadata-only.