Power Pages- Information about blocking anonymous Web API access
Microsoft announcement
We've identified that your Power Pages site has been configured with Global-scoped table permissions on one or more standard tables, including Contact, Account, and Incident (Case). The Web API for these tables is enabled with all columns exposed, and the site setting Webapi/{table}/fields is set to *. This configuration allows anonymous, unauthenticated users access through the portal Web API to read your entire table, including every row and column.
How does this affect me?
To prevent unauthorized access to your data, we are blocking anonymous Web API access to the Contact, Account, and Incident (Case) entities. Please be aware that if your site depends on anonymous access to these tables, the block will break that functionality. Any portal pages, forms, lists, or scripts that rely on anonymously reading the Contact, Account, and Incident (Case) data via the Web API will also be impacted.
What action do I need to take?
If your site relies on anonymous Web API access, please safely re-enable what is required. You can restrict the columns exposed to the Web API by setting the Webapi/{table}/fields site to an explicit, comma-separated list of the specific column logical names required instead of *, so that only the intended fields are ever returned.
In addition, we strongly recommend that you review all your table permissions and edit any that grants more access than necessary, replacing the Global access scope with a more specific scope, such as Contact, Account, or Self. Please remove the Anonymous Users web role from any permission that does not require it.
To identify the affected configuration, run the Power Pages Site Checker from the Power Platform admin center. Select your site, then under Site Health choose Site Checker and select Run. Review the security diagnostic named "Anonymous access to Dataverse tables", which fails when one or more table permissions allow anonymous users to access Dataverse data. You can also open the Security workspace in the Power Pages design studio to review your table permissions and run a security scan.
Review Use governance controls to disable anonymous access , Set table permissions in Power Pages and Overview of the Power Pages portals Web API for additional information.
Please contact Microsoft support and reference ICM842107121 if you need further assistance.
How does this affect me?
To prevent unauthorized access to your data, we are blocking anonymous Web API access to the Contact, Account, and Incident (Case) entities. Please be aware that if your site depends on anonymous access to these tables, the block will break that functionality. Any portal pages, forms, lists, or scripts that rely on anonymously reading the Contact, Account, and Incident (Case) data via the Web API will also be impacted.
What action do I need to take?
If your site relies on anonymous Web API access, please safely re-enable what is required. You can restrict the columns exposed to the Web API by setting the Webapi/{table}/fields site to an explicit, comma-separated list of the specific column logical names required instead of *, so that only the intended fields are ever returned.
In addition, we strongly recommend that you review all your table permissions and edit any that grants more access than necessary, replacing the Global access scope with a more specific scope, such as Contact, Account, or Self. Please remove the Anonymous Users web role from any permission that does not require it.
To identify the affected configuration, run the Power Pages Site Checker from the Power Platform admin center. Select your site, then under Site Health choose Site Checker and select Run. Review the security diagnostic named "Anonymous access to Dataverse tables", which fails when one or more table permissions allow anonymous users to access Dataverse data. You can also open the Security workspace in the Power Pages design studio to review your table permissions and run a security scan.
Review Use governance controls to disable anonymous access , Set table permissions in Power Pages and Overview of the Power Pages portals Web API for additional information.
Please contact Microsoft support and reference ICM842107121 if you need further assistance.
Change history
- 2026-08-07 · Created · All