How to Configure Content Security Policy (CSP) in Power Apps Code Apps

Security is a non-negotiable foundation for any enterprise application — and if you're building with Power Apps, understanding Content Security Policy (CSP) is essential. A misconfigured or missing CSP can leave your apps vulnerable to cross-site scripting (XSS) attacks, data injection, and other client-side exploits. In this guide, we'll walk you through exactly how to configure CSP for Power Apps code apps, step by step, so you can ship with confidence.

Whether you're an experienced Power Platform developer or just getting started, this tutorial will help you implement robust security controls directly within your apps. If you'd like expert guidance tailored to your organisation, explore our Power Platform development services.

What Is Content Security Policy (CSP)?

Content Security Policy (CSP) is an HTTP response header that allows you to control which resources (scripts, styles, images, fonts, etc.) a browser is permitted to load for your application. By defining a strict CSP, you significantly reduce the attack surface for injection-based attacks.

In the context of Power Apps code apps, CSP gives developers fine-grained control over trusted content sources — a critical requirement for enterprise-grade deployments and compliance frameworks such as ISO 27001, SOC 2, and GDPR.

Why CSP Matters for Power Apps

Prevents XSS attacks by blocking unauthorised inline scripts
Restricts resource origins to trusted domains only
Improves compliance posture for regulated industries
Protects end users from malicious third-party content injection
Reduces risk in complex multi-connector app architectures

For organisations running Dynamics 365 implementations alongside Power Apps, a well-configured CSP is especially important as it protects deeply integrated business data flows.

Prerequisites

Before configuring CSP for your Power Apps code app, ensure you have the following:

A Power Apps environment with a code app (PCF or custom page)
System Administrator or System Customiser role in the target environment
Access to the Power Platform Admin Center
Basic familiarity with HTTP headers and browser security concepts

How to Configure Content Security Policy in Power Apps

This article explains how to configure Content Security Policy (CSP) for Power Apps code apps. You can set up CSP directives to control the sources of content that your app is permitted to load.

Step 1: Access the Power Apps Environment Settings

Navigate to the Power Platform Admin Center and select the environment where your code app is deployed. From the environment settings, locate the Privacy + Security section where CSP configuration options are available.

Step 2: Enable Content Security Policy

Toggle the Content Security Policy setting to enabled. When first enabling CSP, it is strongly recommended to use Report-Only mode — this logs violations without enforcing them, allowing you to identify any issues before going live.

Step 3: Define Your CSP Directives

Configure the appropriate directives for your app's requirements. Common directives include:

default-src — Fallback policy for all resource types not covered by other directives
script-src — Defines trusted sources for JavaScript
style-src — Controls permitted stylesheet origins
img-src — Specifies allowed image sources
connect-src — Restricts URLs for fetch, XHR, and WebSocket connections
frame-src — Controls permitted frame and iframe sources
font-src — Defines allowed font file origins

Step 4: Test in Report-Only Mode

Before enforcing your policy, run your app with CSP Report-Only mode active. Monitor the browser console and any configured reporting endpoints for CSP violation reports. Adjust your directives to resolve legitimate violations before switching to enforcement mode.

Step 5: Enforce the Policy

Once you are satisfied that your CSP directives do not block any legitimate app functionality, switch from Report-Only to Enforce mode. From this point, the browser will actively block any content that does not comply with your defined policy.

Common CSP Configuration Mistakes to Avoid

Using unsafe-inline or unsafe-eval — These negate most of the security benefits of CSP. Avoid them unless absolutely necessary.
Overly broad wildcards (*) — Using wildcard sources allows any domain, which defeats the purpose of CSP.
Skipping Report-Only mode — Going straight to enforcement without testing can break your app for end users.
Forgetting connector and API endpoints — Ensure all external API endpoints used by Power Automate flows or connectors are included in connect-src.

Need help auditing your existing Power Apps configuration? Our team offers dedicated Power Platform consulting services to help you build secure, scalable solutions.

CSP and Power Automate Integrations

If your Power Apps code app triggers or receives data from Power Automate flows, ensure that the relevant Microsoft service endpoints are included in your connect-src directive. Failing to do so can silently break automation workflows after CSP enforcement is enabled.

Additional Resources

Ready to Build More Secure Power Apps?

Configuring Content Security Policy is just one layer of a comprehensive Power Apps security strategy. From CSP and role-based access control to data loss prevention policies and environment governance, securing your Power Platform investment requires expertise and a structured approach.

At CRMONCE, our certified Power Platform specialists help organisations design, build, and secure Power Apps solutions that meet enterprise compliance requirements — without slowing down delivery.

Get in touch with our team today to discuss your Power Apps security requirements, or explore our full range of services to see how we can support your digital transformation journey.