Power Pages BYOC: Secure React sites with Dataverse access controls
Diesen Beitrag auf Deutsch lesen
A tutorial for hosting React code in Power Pages while configuring Web API exposure, CSRF protection, authentication and Dataverse permissions.
TL;DR
Power Pages single-page applications can host a React site while retaining Power Pages authentication and Dataverse security. The tutorial enables selected Web API tables and fields, uses a CSRF token helper, configures table permissions and web roles, adds Entra External ID sign-in, and limits records to the signed-in user.
Original by Nick Doelman, on ReadyXRM Blog. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Build and test React sites in a non-production Power Platform environment, then verify the generated code and Web API behavior before deployment.
- Admins/CoE: Enable only required Dataverse tables and columns, avoid using an asterisk for fields, and configure table permissions and web roles explicitly.
- Security/Compliance: Require CSRF tokens for Web API calls and test unauthenticated, authenticated and signed-out access so users cannot retrieve records belonging to others.
- Leadership/Business: Treat the coded front end as an extension of Power Pages controls, not a replacement for its hosting, authentication and data security model.
Frequently asked questions
How do I allow a React single page app to read Dataverse data?
Enable each table through the site setting Webapi/tablename/enabled set to true, and list the columns by name in Webapi/tablename/fields.
How does the tutorial limit which records a signed-in user sees?
The tutorial configures table permissions and web roles so that only authenticated users can see their own session records.
What limits does the article mention for BYOC code sites?
Local preview cannot reach Dataverse, so you test the integration after uploading the site to Power Pages. The design studio disables the pages and style workspaces for code sites.