Services
Power Apps
Details
How does this affect me?
After January 30, 2026, Power Apps code apps that call assets outside of Power Apps domains will have those requests blocked by default. The code app will play, but these assets called from an external source will not load.
Please visit How to: Configure Content Security Policy (preview) - Power Apps for more information about the default CSP configuration.
What action do I need to take?
To enable your code app to call assets from external sources, you will need to allowlist any required external sources using the CSP configuration settings in the Power Platform admin center.
To prepare for this change, we recommend you configure CSP by using Power Platform admin center and follow the steps below. We recommend taking these steps if you are unsure about what your CSP configuration should be, and your code app is business critical:
- Temporarily toggle off the Enforce content security policy setting.
- Toggle on the Enable reporting setting.
- Test which sources need to be added to your allowlist after the enforcement date of January 30, 2026.
- Add the required sources to your allowlist.
- Toggle on the Enforce content security policy setting.
Please contact Microsoft Support if you need further assistance.