When creating websites, for the public it’s crucial to ensure that authorized individuals can access business data. Power Pages implements a security framework to safeguard your business information effectively. Let’s learn Power Pages security
- Site visibility
- Authenticated users
- Web roles
- Table permissions
- Page permissions
- HTTPS Headers
Site visibility:
Controlling who can view your Power Pages sites is crucial, for site visibility. By default these sites are accessible to users within your organization. Microsoft Entra authentication adds a level of security reducing the risk of exposure of unfinished website content and designs.
Once your website is prepared for launch switch the Site visibility in Power Pages to public. This setting allows the site to be accessed by anyone, on the Internet anonymously or by users authenticated through identity providers.
Authenticated users:
Contacts, in Microsoft Dataverse are essentially users of Power Pages. These users can log in to your website through authentication methods. You have the option to link Power Pages with authentication services such as Azure AD B2C, Microsoft and LinkedIn. Once authenticated users can be granted web roles that determine their access to content, on the website.
Power pages web roles:
Web roles enable individuals to carry out tasks or gain entry, to restricted content and information on the website. These roles are connected to users, table privileges and page permissions. As users can have than one web role assigned to them they are able to accumulate access rights to resources on the site.
Every authenticated user, also known as contacts is automatically placed in the authenticated users in powerapps web role. On the hand anonymous users who have not logged in can browse a website. Obtain access to resources, through the Anonymous Users web role.
Table permissions:
Accessing Dataverse data, via lists, forms, Liquid and the Web API is safeguarded by table permissions. These permissions can be customized to grant varying levels of access and rights to records. They are linked to web roles to ensure users have the access privileges.
Page permissions:
The permissions assigned to web roles for page access help safeguard the content and elements found on pages.
HTTPS Headers:
The CORS protocol includes a series of headers that determine if a response can be shared with a domain. You can enable CORS functionality, in Power Pages through the Portal Management application by adjusting and setting up the site configurations.