Dynamics 365 Tech Blogs: Microsoft Entra External ID Solution

A practical guide to user authentication, Power Pages identity association, authorization, and sign-in email changes.

Solution overview
Main components
Authentication
Authorization
Identifiers
Email change
Failure handling
Responsibilities

1. Solution overview

A Power Pages site can use Microsoft Entra External ID to authenticate external users. Dataverse stores each site user's Contact record, authorization configuration, profile information, and application-specific business data.

The central idea
The email address is the name the user enters at sign-in. The Entra user ID is the stable account identifier. Changing the sign-in email does not create a new account.

External user
    |
    | signs in with email and password
    v
Microsoft Entra External ID
    |
    | returns a signed identity token
    v
Microsoft Power Pages
    |
    | associates the identity with a Contact
    v
Microsoft Dataverse  --------->  SharePoint Online
Contact + business records        Related documents

2. Main components

Microsoft Entra External ID

Owns the external user account, sign-in identity, password, MFA methods, authentication policies, and identity tokens.

Microsoft Power Pages

Acts as the portal application, validates the Entra token, creates the portal session, and connects the identity to a Dataverse Contact.

Microsoft Dataverse

Stores Contacts, web roles, table permissions, profile information, and application-specific business data.

Microsoft Graph

Provides the secure backend API used to update the Entra user when a solution supports a custom sign-in email change.

3. Authentication methodology

Authentication answers one question: Who is signing in? Entra performs the credential check; Power Pages consumes the result.

The user opens the Power Pages site. Power Pages redirects the browser to the configured Entra External ID user flow.
Power Pages identifies itself. The request includes the Entra Application/Client ID and approved redirect URL.
The user enters credentials. Entra uses the email sign-in identity to locate the account and validates the password and required MFA.
Entra issues an ID token. The signed token identifies the user, tenant, and intended application.
Power Pages finds the Contact. Power Pages uses the stable oid or sub identity value to find the related Dataverse Contact.
Power Pages creates the portal session. The user can access pages and records allowed by web roles and table permissions.

Example identity token

{
  "oid":   "U-123",
  "sub":   "P-987",
  "email": "[email protected]",
  "aud":   "APP-456",
  "tid":   "TENANT-001"
}

The Power Pages site ID is not part of the email identity
The email belongs to the Entra user. The Power Pages application is identified separately by its Application/Client ID and redirect URL.

4. Authorization methodology

Authorization answers a different question: What is this authenticated user allowed to access?

Control	Purpose
Power Pages web role	Defines the portal role, such as Authenticated Users.
Dataverse table permission	Limits access to records related to the signed-in Contact.
Page permission	Restricts protected pages to appropriate web roles.
SharePoint document integration	Allows document access through the authorized Dataverse parent record and Document Location permissions.

Authentication does not grant data access by itself
A valid Entra login proves control of the account. Power Pages and Dataverse still decide which site records the Contact may access.

5. Important identifiers

Identifier	Example	Changes with email?
Entra user/object ID	U-123	No. This is the stable account identifier.
Email sign-in identity	[email protected]	Yes. This is changed through Microsoft Graph.
Application/Client ID	APP-456	No. This identifies the Power Pages application.
Dataverse Contact ID	C-789	No. The user remains linked to the same Contact.
Contact communication email	emailaddress1	Only if the solution intentionally synchronizes it.

Before email change
-------------------
Entra user ID:       U-123
Sign-in email:       [email protected]
Application ID:      APP-456
Dataverse Contact:   C-789

After email change
------------------
Entra user ID:       U-123             unchanged
Sign-in email:       [email protected]     changed
Application ID:      APP-456           unchanged
Dataverse Contact:   C-789             unchanged

6. Sign-in email change methodology

Entra External ID does not provide a complete Power Pages self-service sign-in email-change experience. The solution must implement the verification and backend update process.

Collect the new email. The authenticated user enters a new sign-in email in Power Pages.
Create an Email Change Request. Dataverse records the Contact, Entra user ID, old email, new email, status, expiry, attempt count, and error details.
Verify the new address. The solution sends a time-limited code or link. Nothing changes until verification succeeds.
Update Entra using Microsoft Graph. A server-side component changes the email identity's issuerAssignedId.
Update the profile email if required. If sign-in and communication emails must match, update the Dataverse Contact after Entra succeeds.
Complete and audit the request. Store completion and support information without storing the verification code in plain text.

Recommended Power Pages implementation

Power Pages user interface
        |
        v
Dataverse Email Change Request
        |
        v
Dataverse Custom API / asynchronous plug-in
        |
        v
Microsoft Graph
        |
        +----> Entra sign-in email
        |
        +----> Contact profile email, if required

Microsoft Graph collection update
Updating identities[] replaces the collection. The backend must preserve other existing identities while changing the email entry.

7. Failure handling

Failure	Expected behaviour
Verification code is wrong or expired	Reject or expire the request. Keep the old sign-in email.
New email is already used	Reject the request. Do not retry.
Temporary Graph error	Retry server-side using Retry-After or exponential backoff, with an attempt limit.
Permanent Graph error	Mark failed, record the error, and route it to support.
Entra succeeds but Dataverse update fails	Login still works. Record and retry the profile synchronization.

Data consistency, not normally a login outage
If Entra succeeds but Contact synchronization fails, the user can still sign in. The risk is an outdated profile, incorrect notifications, or stale data reused by the site.

8. Responsibility summary

Capability	Responsible component
Sign-in email and password	Microsoft Entra External ID
MFA and identity policies	Microsoft Entra External ID
Portal session	Microsoft Power Pages
Identity-to-Contact association	Power Pages external identity configuration and Dataverse
Record and page access	Power Pages roles, page permissions, and Dataverse table permissions
User profile email	Dataverse Contact
Custom sign-in email update	Server-side solution process using Microsoft Graph

9. Microsoft references

Confirm final field mappings, permissions, identity claims, and operational ownership against the approved Power Pages solution design.

Microsoft Entra External ID Solution

Contents