Power Pages, a powerful platform within the Microsoft Power Platform ecosystem, allows businesses to build external-facing websites integrated with Dataverse and other Microsoft services. While the platform offers flexibility in user authentication, one crucial aspect of security is managing anonymous access.

Understanding Anonymous Access

Anonymous access refers to the ability of users to view or interact with a Power Pages site without signing in. By default, Power Pages can be configured to allow public access to certain pages or data without requiring authentication. This feature is useful for publicly available content such as informational pages, FAQs, or marketing material. However, when dealing with sensitive business data, allowing unauthenticated users to access content can pose a significant security risk.

Why is disabling anonymous access important?

Enhances Security: Prevents unauthorized access to sensitive business data.

Ensures Compliance: Helps meet regulatory standards like GDPR and HIPAA.

Reduces Cyber Risks: Protects against data breaches and unauthorized modifications.

Prerequisites:

Access to power platform admin center.

Step-By-Step Guide:

Open the Power Platform Admin Center   https://admin.powerplatform.microsoft.com and select the environment where your Power Pages site is hosted.

Navigate to the Resources section in the left panel to access the available resources for your environment.

Click on Power Pages sites and select the specific site you want to configure for security settings.

Open the Your Sites section and select Governance Controls and select Disable anonymous access to Dataverse option to disable access.

A side panel will appear, displaying various options to configure access settings for the site.

None of the sites: Keep anonymous access enabled for all sites without any restrictions (default setting).

Specific sites: Choose particular sites where anonymous access should be disabled while allowing it for others.

All sites except specific sites: Block anonymous access for all sites except the ones explicitly permitted.

All sites: Disable anonymous access across all Power Pages sites to enforce strict authentication requirements.

Choose the appropriate settings based on your requirements and select specific sites if needed.  

Click OK and Save to apply the changes, after which a confirmation message will appear indicating a successful update.

After saving the changes, navigate to Power Pages, open the website, and access the Permissions section to review the applied settings.

You will see that the Anonymous Users role has been deactivated in the Permissions section.

Governance Controls in Power Pages help manage site security by restricting anonymous access. They allow organizations to enforce authentication, safeguarding sensitive data and ensuring compliance. With these controls, access can be customized for all sites or specific ones based on requirements.

Frequently Asked Questions (FAQs):

1. What is anonymous access in Power Pages?

Anonymous access allows users to view and interact with a Power Pages site without requiring authentication.

2. Why should I disable anonymous access in Power Pages? 

Disabling anonymous access enhances security, protects sensitive data, and ensures compliance with industry regulations.

3. Can I restrict anonymous access for specific sites only?

Yes, Governance Controls allow you to disable anonymous access for all sites, specific sites, or all except selected ones.

4. What happens after disabling anonymous access?

Once disabled, only authenticated users will be able to access the site, and the Anonymous Users role will no longer be active in the Permissions section.