Microsoft Power Pages misconfigurations exposing sensitive data

Research from AppOmni (Aaron Costello) found that misconfigurations in Microsoft Power Pages—such as granting global table access, allowing public registration that confers elevated "authenticated user" permissions, and not enabling column-level masking—have exposed millions of records (including a reported NHS leak of 1.1 million employees' PII). The issue stems from layered access-control complexity and skipped security steps; a PoC using an intercepting proxy (Burp Suite) shows how exposed tables and sensitive columns can be enumerated, and AppOmni recommends removing excessive external access and tightening table/column permissions.