A Power Pages permission linked to a web role from a different site

Portal table permission is attached to another site's web role.

A table permission is linked to a web role from a different site. Power Pages evaluates permissions within one site, so the link grants nothing while the design studio shows it as active.

It is reported because it does not look like nothing: somebody who intended to grant access believes they have. The two practical readings are that the intended grant is silently missing, or that the link is a leftover from a site that was copied or deleted. Neither is an exposure, which is why it sits at Low.

Open each table permission, column permission profile, and page access rule, look at the web roles attached, and check which website each of those roles belongs to. A role from a different site is the finding. Worth checking the same way for anything else still pointing at a site that was deleted.

Attach a role from the same site if the access was meant to work, or remove the link if it is a leftover.

This one is environment health, so it carries a plain label and no control mapping. Presenting an operational gap as a security finding would make the real security findings harder to trust, so we keep the two apart.

• A plugin step that re-triggers itself on every save
• Two plugin steps at the same execution order writing one column
• A plugin registered twice on the same message
• An update plugin step with no filtering attributes