Well, I am glad someone is doing research in this area. Powerapps are one of those things I hope I never have to deal with in a security incident. The logging a

Well, I am glad someone is doing research in this area. Powerapps are one of those things I hope I never have to deal with in a security incident. The logging and access control is messy but the underlying implementation uses normal azuread authentiation/access control. Let's say a random user creates an app to measure something for their team, store it in sharepoint and update the avatar or some other property of users stored in azuread. Because of that latter part, the powerapp might (!) have requested and been granted directory.readwrite.all which means it can do anything at all including making itself or whoever can somehow control it and abuse it global admin, controlling the whole tenant. A lot of this stuff is for business customers only, I suspect that's why you see little research or random threat actors abusing these types of features (until they're not random anymore).