Three Layers of Power Pages Security: CAPTCHA, WAF, and Azure DDoS Protection

When designing a public-facing Microsoft Power Pages website, three security controls frequently appear: CAPTCHA, Web Application Firewall (WAF), and Azure DDoS Protection. Although all three help address malicious traffic, they operate at different layers, have different scopes, and cannot replace one another.

Microsoft Entra External ID Solution

A practical guide to user authentication, Power Pages identity association, authorization, and sign-in email changes.

Power Pages Identity and Account Change Design

A Power Pages solution can use Microsoft Entra External ID to authenticate portal users. Microsoft Power Pages then associates the authenticated identity with a Dataverse Contact record. This article explains how those identities are connected, how email changes should work, and what is required to support Google, Facebook, BC Services Card, or another third-party identity provider.

Calling Server-Side Dataverse Logic from Power Pages Using a Custom Table Bridge

Author: Forrest Zhang

Power Pages is a good option for building external-facing Dataverse applications, but sometimes the portal needs to run server-side business logic that should not live in JavaScript. For example, the portal may need to check related records, apply duplicate-detection rules, update a status, or return a calculated result.

Microsoft Entra External ID Integration with Power Pages

Version: 2026-04-28
Author: Forrest Zhang

This guide explains how to configure Microsoft Entra External ID as the customer identity provider for a Power Pages site. It is written for admins/developers who need to repeat the setup in another environment.

This manual is based on the COA Demo integration path that was tested end to end. It includes not only the steps, but also why each step matters and what went wrong during troubleshooting.

Designing Defensible Signature Experiences in Microsoft Power Pages

A risk-based blueprint for replacing PDF signatures in modern online intake portals

Showing Terms & Conditions (or Privacy Notice) in a Power Pages site that uses Azure AD B2C

 Why this matters

When you off‑load sign‑in to Azure AD B2C, the portal’s native login screen is bypassed. That can make it look as if the Authentication/Registration/TermsAgreementEnabled switch no longer works. It does—there are just a few extra pieces you need to wire up.

localStorage vs. Cookies — When to Use Each for Front-End State

Both localStorage and cookies let you remember things in the browser. They solve overlapping problems, but each one shines in a different scenario. Here’s a concise guide, plus a real example from an “on-boarding” tooltip that only shows the first time you visit a page.

Checking Whether a Signed-In User Has a Specific Web Role in Power Pages

Scenario — You need client-side JavaScript to behave differently depending on whether the portal contact holds a particular Web role (e.g. “My Demographics Access”). Power Pages doesn’t expose Web-role data directly to JavaScript, so you must pass that information from Liquid into the page.

Adding a Custom Calendar Filtered by ID from Page URL in Power Pages

Integrating a calendar into a Power Pages portal can enhance the user experience by displaying scheduled events dynamically. This article guides you through adding a FullCalendar instance to Power Pages, retrieving events via Web API, and filtering them by an ID retrieved from the page URL.

How to Utilize Web API in Power Pages: A Comprehensive Guide

 Power Pages Web API empowers you to create rich, interactive web experiences by enabling seamless communication between your web pages and backend data. This article will guide you through the process of setting up and utilizing the Web API in Power Pages, drawing insights from official Microsoft tutorials and a helpful YouTube video.

How to Redirect Users to a Home Page or Custom Page After They Sign In

 If you’re using Power Apps portals (now Power Pages) or a similar setup with Azure Active Directory (AD) / Azure B2C logins, you may want users to land on a home page—or different pages depending on how they signed in—rather than the default profile page. Below are the core steps to achieve this, along with examples of handling custom query parameters.

Resolving Metadata Setting Attribute Value Failures in Power Pages

 Introduction

When integrating Power Pages with Dynamics 365, you might encounter an issue where changes to field attributes through Power Pages metadata settings do not reflect due to Dynamics 365 fields being set to read-only. This article provides a straightforward explanation and solution to this common problem.

Two Approaches to Make a Lookup Column Read-Only While Retaining Programmatic Updates In Power Pages (Powerapps Portal)

 In certain scenarios, you may want to present a lookup field on a form as if it were read-only, while still allowing scripts to programmatically set or update its value behind the scenes. Here are two methods to achieve this without disabling the field entirely, thus preserving your ability to set its value via code:

How to Remove Hyperlinks from the First Column of an Entity List in Power Pages

 Background

In Power Pages (formerly known as Power Apps portals), Entity Lists often present clickable hyperlinks on the first column. While this is convenient for navigation to detailed records, sometimes you might want to display this information as plain text instead. For example, you may have a “Case Number” or “Grievance Number” column that you want visible, but not clickable.

RE: How to set a Notification / Message on Portal Pages

 RE: How to set a Notification / Message on Portal Pages

Reference: 1

There is no OOB feature to set a Notification / Message on Portal Pages.

We can create a custom Notification entity to create your notifications

in the Portal Header Web Template (after the profile navigation menu), can add a FetchXML to retrieve this records and show a bell icon (or any custom icon)

How to Replicate a Power Pages Site within the same environment

 Creating a duplicate of a Power Pages site within the same environment requires careful planning and execution. This article outlines the structured approach to replicate a Power Pages site, focusing on security, permissions, and content management from the outset.

Add Google Analytics tag to your Power Pages site or Specified Web Pages

 You can add Google Analytics tag to your Power Pages site to monitor specific traffic analytics and trends.

Enhancing Form Security in Power Pages: Masking Input Fields

Enhancing Form Security in Power Pages: Masking Input Fields

Introduction: In the digital era, ensuring the security and confidentiality of user inputs on web forms is paramount. One common practice is masking sensitive information fields, such as passwords, to prevent over-the-shoulder snooping. In Power Pages, this can be achieved with a simple tweak. This article walks you through the steps to mask an input field, using jQuery for a seamless user experience.

 

How to Enable Anonymous Access in Power Pages

Enabling anonymous access in Power Pages (formerly known as Power Apps portals) allows visitors to access your portal without needing to log in, making it an essential feature for public websites, including blogs, informational sites, and more. In this guide, we'll walk you through the steps to enable anonymous access, focusing on ensuring table permissions for the anonymous web role and setting site visibility to public.