A Power Pages site with open self-registration
What it is
Anyone on the internet can register an account on this site.
Why it matters
The site accepts open registration, so anyone can create an account. Authenticated stops meaning vetted: every permission on the authenticated-users role is one self-service sign-up away from the open internet.
Open registration is a legitimate configuration for a genuinely public community site, so the question to answer is whether anything here assumes a signed-in visitor was invited, approved, or known. It fires on a platform default that is enabled, so a site with no such setting row is open and the finding is correct: check whether you meant this rather than assuming somebody misconfigured the site. A private site neutralises it, and site visibility is not readable by an unattended scan.
Find it yourself
Portal Management, Site Settings, look for Authentication/Registration/OpenRegistrationEnabled and the master gate Authentication/Registration/Enabled. Read this next part carefully, because it is where a manual check goes wrong: the platform default is enabled, so finding no setting row does not mean registration is closed. It means the default applies and registration is open. Verify by attempting to register from a private browser window.
How to fix it
Set OpenRegistrationEnabled to false explicitly if self-service sign-up is not intended, and use invitation codes for controlled onboarding.
Related controls
These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.
CMMC relevance
This condition produces evidence for AC.L2-3.1.1 (Level 1: limit system access to authorized users, processes and devices), for the Dataverse system in your assessment scope. 3.1.1 turns on which users are authorized. Open self-registration means the answer is anyone who fills in a form, which dissolves what the word authenticated is doing everywhere else in the portal's configuration. This fires on a platform default, so the question is whether you meant it rather than whether somebody broke it.
Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.
Pathix checks this across every environment you scan, along with 39 other conditions. Self-hosted in your own Azure, read-only, metadata-only.