Power Pages: Open a Portal to Your Clients Without Exposing Everything

You've almost certainly had this need: letting outside people, clients or vendors, view or enter information. Without handing them the keys to the house. That's exactly what Power Pages is for.

Very concrete use cases

• A vendor portal where each one tracks its orders and uploads its documents.
• A client space to view cases, quotes, and invoices.
• A public form that feeds straight into your database, with no re-keying.

How the security works, in plain terms

Power Pages is built on Dataverse. External access is set at three levels: web roles (which determine what a visitor can do), table permissions (read, write, on which data), and above all the scope. The scope is the key setting: it says "this client sees ONLY their own orders," not anyone else's. A misconfigured portal is almost always a forgotten scope.

The reflex you can't skip

By default, assume everything is closed, and open access drop by drop. Never the other way around. Every exposed table should be a conscious decision: who, what, how far. Five minutes of discipline here saves you a data leak later.

Key takeaways

• Power Pages exposes your Dataverse data in a controlled way.
• Security plays out at three levels, and scope is the most critical.
• Start from everything closed, and open consciously, table by table.
• Test isolation with two accounts before any go-live.