When designing a public-facing Microsoft Power Pages website, three security controls frequently appear: CAPTCHA, Web Application Firewall (WAF), and Azure DDoS Protection. Although all three help address malicious traffic, they operate at different layers, have different scopes, and cannot replace one another.
Dynamics 365 Tech Blogs
Microsoft Entra External ID Solution
A practical guide to user authentication, Power Pages identity association, authorization, and sign-in email changes.
Power Pages Identity and Account Change Design
A Power Pages solution can use Microsoft Entra External ID to authenticate portal users.
Microsoft Power Pages then associates the authenticated identity with a
Dataverse Contact record. This article explains how those identities are
connected, how email changes should work, and what is required to support
Google, Facebook, BC Services Card, or another third-party identity provider.
Calling Server-Side Dataverse Logic from Power Pages Using a Custom Table Bridge
Author: Forrest Zhang
Power Pages is a good option for building external-facing Dataverse applications, but sometimes the portal needs to run server-side business logic that should not live in JavaScript.
For example, the portal may need to check related records, apply duplicate-detection rules, update a status, or return a calculated result.
How to Set Up Google, Apple, Microsoft, and Facebook Login with Supabase Auth
This guide walks through a practical web setup for four common identity providers with Supabase Auth:
- Apple
- Microsoft, shown as Azure in Supabase
The examples use placeholder values so you can adapt the steps to any app.
How to Show SharePoint Documents in Model-Driven Apps and Power Pages
Author: Forrest Zhang
When using SharePoint document management with Dataverse, the right configuration depends on where you want users to see and manage the files. A model-driven app and a Power Pages site may both use Dataverse and SharePoint, but the document display pattern is not the same.
The key difference is this: model-driven apps use the SharePoint document experience through sharepointdocument, while Power Pages uses a form subgrid based on Document Locations. Mixing these patterns can lead to confusing configuration and broken document behavior.
Microsoft Entra External ID Integration with Power Pages
Version: 2026-04-28
Author: Forrest Zhang
This guide explains how to configure Microsoft Entra External ID as the customer identity provider for a Power Pages site. It is written for admins/developers who need to repeat the setup in another environment.
This manual is based on the COA Demo integration path that was tested end to end. It includes not only the steps, but also why each step matters and what went wrong during troubleshooting.
How to Disable 2FA in Microsoft Entra ID
Author: Forrest Zhang
Disabling two-factor authentication in Microsoft Entra ID is not always a single-setting change. In many tenants, MFA can be enforced from several different places, so turning off one control does not necessarily stop sign-in prompts.
The practical issue is that administrators often disable Security Defaults and still see users prompted to register Microsoft Authenticator or complete MFA. Based on Microsoft documentation, that usually means another enforcement path is still active, such as the registration campaign, Conditional Access, per-user MFA, authentication method settings, or Microsoft’s mandatory MFA requirements for certain admin portals.
A Simple Guide to GitHub: Basic Concepts Many People Still Find Confusing
Author: Forrest Zhang
Recently, I noticed that many people do not fully understand GitHub, especially some less commonly used concepts such as fork, license, CLA, contributing, PR, and pull request. For people who are not professional software developers, GitHub can look confusing at first. There are many English terms, many buttons, and many workflows that seem technical. But the truth is simple: GitHub is mainly a platform for storing code, tracking changes, and letting people work together on software projects.
In this article, I will explain the most important GitHub concepts in plain English. The goal is not to turn you into an expert right away, but to help you understand what these words really mean and how they connect to each other in real projects.
Document Malware Scanning in Dynamics 365: What’s Covered by SharePoint vs Dataverse
Author: Forrest Zhang
When someone asks whether “Dynamics 365 supports virus scanning or document quarantining,” the correct answer is: it depends on where the document is stored. In Microsoft’s ecosystem, documents attached to Dynamics experiences typically live in one of two places:
- SharePoint / OneDrive (via Dynamics 365 “Document Management” integration)
- Dataverse (Notes/attachments, File columns, and other Dataverse-backed storage)
Both can provide malware protection, but the capabilities and the operational behavior differ.
How to Add a Custom Ribbon Button to the Global Command Bar in Dynamics 365 CRM
The Global Command Bar is the toolbar at the top of every screen in your model-driven apps. This guide shows exactly how to add your own custom button to it using Ribbon Workbench.
What we will build: A “Create Case” button that opens a new Case form in a new browser tab — available everywhere in the app.
Document Governance for Audit-Ready Workflows: SharePoint + Dataverse Linking (Version-Proof Evidence)
Author: Forrest Zhang
Implementation Track: Post C (Audit-Ready Modernization)
Thumbnail Grid PCF: User Guidance
Author: Forrest Zhang
•
Version: 0.2.3
The Thumbnail Grid PCF turns a standard Dataverse subgrid into a clean, visual card layout with image, title, subtitle, and badges. It is useful when users need to quickly understand records by picture (files, products, assets, properties, listings, etc.) instead of scanning rows.
Dataverse + Cloudflare Integration Playbook
Author: Forrest Zhang
A privacy-safe reference architecture for secure, scalable self-service portals backed by Microsoft Dataverse—written as a reusable technical reference without any product or client branding.
Workflow Event Log in Dataverse: What to Capture (and What Not To) for Audit-Ready Traceability
Author: Forrest Zhang
Implementation Track: Post B (Audit-Ready Modernization)
Implementing Audit-Ready Status Transitions in Dataverse (Custom API + Guard Plugin Pattern)
Author: Forrest Zhang
Series: Audit-Ready Modernization – Implementation Track (Post A)
Designing Defensible Signature Experiences in Microsoft Power Pages
A risk-based blueprint for replacing PDF signatures in modern online intake portals
From One-Off Projects to Repeatable Platforms: Proving Impact with Metrics and Reusable Components
Author: Forrest Zhang
Series: Audit-Ready Modernization (Part 3 of 3)
RBAC That Scales: A Governance Model for Regulated Workflows (Role × Scope × Authority)
Author: Forrest Zhang
Series: Audit-Ready Modernization (Part 2 of 3)
Audit-Ready by Design: A Practical Framework for Modernizing Regulated Operations at Scale
Author: Forrest Zhang
Series: Audit-Ready Modernization (Part 1 of 3)
Dataverse Custom API vs. Classic Action
In Microsoft Dataverse / Dynamics 365 projects, we often need a clean way to implement “business operations” such as Submit, Approve, Reject, Close, Recalculate, or Validate. Two common options come up:
- Custom API (modern, contract-based)
- Classic Action (legacy process-based “Action”)
This article compares them in plain language, with real scenarios and governance considerations (security, auditability, and maintainability). It’s designed for solution architects, functional consultants, and makers who need to make the right platform choice, not just “get it working.”
How to Make Apps Reappear in macOS Applications After Moving Them
If you move apps to an external drive, they will disappear from the Applications folder. This is expected behavior. The fix is simple.
Do Dataverse Application Users Need API Permissions or Admin Consent?
Short Answer: No.
When you use the Dataverse application user pattern, you do not need to:
-
Add “Dynamics CRM” API permissions to your app registration, or
-
Click “Grant admin consent” in Entra ID (Azure AD).
Everything is governed by the Dataverse application user + security roles, not by Entra “API permissions”.
Implementing Dynamic Subgrid Filtering in Power Apps Model-Driven Forms Introduction
In the Rental Smart MVP project, we often need to display filtered data in subgrids on forms like the Property form. This helps property managers quickly view owner expenses without clutter. Here's a simple JavaScript function to dynamically filter the Owner Expense History subgrid for Bills that are historical (Paid or Void), linked to the property owner, and not unit-specific. It uses setFilterXml for UCI compatibility and assumes the subgrid is set up as a related entity grid for Charges.
Dataverse Date & Time columns: a practical guide
The two settings that matter
-
Format: Date only or Date and time.
-
Behavior: User Local, Date Only, or Time zone independent.
These decide storage, conversion, and what users see.
Deploying a Custom PCF Control from GitHub to Dynamics 365 as an Unmanaged Solution
Introduction:
This tutorial guides you through building and deploying a Power Apps Component Framework (PCF) control from GitHub source code (already saved to a local folder like C:\PCF\RepoName) into a Dynamics 365 (Dataverse) DEV environment. We'll use an unmanaged solution for easy edits or deletion. This method uses production builds to avoid issues like the 'eval()' security flag in the Solution Checker.
How to Register Service Endpoint in the Dataverse Plugin Registration Tool?
Follow the below steps to Register the Service Endpoint in the Dataverse Plugin Registration Tool.
Counting specific-user changes in Dataverse with Audit History
Goal
Show how to count distinct records whose tracked columns were changed by a specific user (e.g., a Power Pages account), using Audit History only.
Optimizing Form Performance in Dynamics 365 Finance and Operations: Four Essential Tips
In Dynamics 365 Finance and Operations (D365 F&O), forms are the frontline of user interaction, but poor performance can turn them into bottlenecks—slow loads, UI freezes, and database contention frustrate users and tank productivity. Based on standard Microsoft practices and real-world developer discussions, this article breaks down four key optimization tips: judicious use of select forupdate, query indexing, minimizing client-side loops, and deferring non-essential data asynchronously. These aren't optional niceties; ignore them, and your forms will drag, especially in high-volume environments. We'll explain each with examples, assuming the latest online D365 F&O—no outdated hacks here.
Understanding Table Methods and Transactions in Dynamics 365 Finance and Operations
In Dynamics 365 Finance and Operations (D365 F&O), working with table methods and transactions is fundamental for ensuring data integrity and extending system behavior without overwriting base code. This article dives into Chain of Command (CoC) extensions, the Transaction Tracking System (TTS), key table methods like insert/update/delete and their variants, and the nuances between validation methods such as validateField and reactive ones like modifiedField. Based on real-world discussions and standard Microsoft practices, we'll cover the essentials with examples. Assume the latest online D365 F&O version unless specified otherwise— no outdated workarounds here.
Subscribe to:
Posts (Atom)