Power Pages record access for external users across multiple customer accounts
Diesen Beitrag auf Deutsch lesen
Account scope follows only one contact-to-account relationship. Design, assign and test Power Pages table permissions so external users reach just the records they are approved to use.
TL;DR
Power Pages grants external users access to Dataverse records only through the relationship selected on each table permission. Account scope covers the account linked to the signed-in contact, not every separate membership. Write the access rule first, map contact-to-account paths, assign focused web roles with only needed operations, and test allowed and denied access, including direct URLs and Web API requests, before launch.
Original by Softchief Author, on Softchief Technologies. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Map the relationship path from contact to every protected table before assigning permissions, because hiding a page or list does not secure the underlying records.
- Admins/CoE: Confirm each test sign-in resolves to the correct Dataverse contact, check for duplicates, and keep sensitive table permissions off the broad Authenticated Users web role.
- Security/Compliance: Require negative tests that try to reach records from unrelated accounts through direct URLs and the Web API, since a hidden list does not prove the record is protected.
Frequently asked questions
Does Power Pages account scope cover all accounts a contact belongs to?
No. Account scope follows only the single account relationship selected on the table permission, so separate memberships need their own supported design.
Do Power Pages page permissions secure Dataverse records from direct Web API calls?
No. Page permissions only control who can view page content, while table permissions protect records across lists, forms, Liquid and the Web API.
How do I test Power Pages access for a user with multiple account memberships?
Use test contacts with one account, several memberships and none, then verify allowed tasks and attempt to open an unrelated record by direct URL.