Security Practices and Solutions
View All Tags
Sharing a canvas app with a security group lets every member run it, and anyone added to the group later gets the app without another share. This guide shares an app in the new Share dialog and covers two things it doesn't do: give access to your data, and tell people.
Being a Global or Power Platform admin doesn't make you System Administrator of an environment's Dataverse. Microsoft stopped assigning that role to admins automatically. When you need it, you give it to yourself in the Power Platform admin center, in four clicks.
When an app keeps its data in SharePoint, everyone who uses the app needs permission on the SharePoint site too. SharePoint's obvious Share site button can't give the permission an app's users usually need, and its other sharing dialog quietly adds people to the site's Members group. This guide gives a security group exactly Contribute, and nothing more.
Giving a team access to something one person at a time works until someone joins or leaves. Then you're editing access in five places. A security group fixes that: you give access to the group once, and from then on you only change who is in it.
Every app that talks to Claude, from a ten-line script to a full AI agent, needs an API key. Getting one takes about two minutes in the Claude Console. This guide shows every screen, explains each setting, and covers what most guides skip: storing the key safely, paying for usage and replacing a key later.
Being Owner of an Azure subscription does not let you read a single secret in a Key Vault you just created. The fix is one role assignment — and once you understand its three parts, you can grant exactly the access you mean, to a person or to an app, in about a minute.
You added API permissions to an Azure app registration, requested a token, and got back AADSTS65001 instead. The token endpoint is telling you something simple: the permissions are configured, but nobody has actually consented to them yet.
Your installation is collecting. This part reads every panel on the dashboard — and starts with the thing that makes this product different: it tells you in plain sentences why it thinks a visit was a person or a machine, states how many readings each figure could actually be taken from, and says "not known" rather than guess.
Your dashboard currently answers on 127.0.0.1 and nowhere else, which is safe but unusable. This part gives it a real domain name and a free, automatically renewed HTTPS certificate using Caddy — six lines of configuration, no certbot, no cron job, and no renewal to forget.
Your firewall says Default: deny (incoming). Your database is answering the internet anyway. This part shows the port scan that proves it on a real server, explains the iptables chain order that causes it, and fixes it with a Compose override file — not by fighting the firewall.
