Power Pages - Power Pages version 9.8.7.x Hotfix Release
Microsoft announcement
Maintenance window start for Non-Production Environments: August 11, 2026, at 6:00 PM UTC
Maintenance window end for Non-Production Environments: August 12, 2026, at 3:00 AM UTC
Maintenance window start for Production Environments: August 12, 2026, at 6:00 PM UTC
Maintenance window end for Production Environments: August 13, 2026, at 3:00 AM UTC
The Power Pages hotfix release 9.8.7.x will contain security enhancements for the Webapi and Entity List Search and Anonymous Web API Access.
To prevent unintended, overly permissive permissions from causing broader data disclosure risks, the * wildcard can no longer be used with the Webapi/{table}/fields site setting for anonymous access to system tables.
The following system tables that will no longer allow anonymous access through the WebAPI with * wildcard in site setting Webapi/{table}/fields: contact, systemusers, account, annotation, lead, incident, opportunity, salesorder, queue, task, businessunit, team, quote, invoice, product etc.
What action do I need to take?
To identify if you have affected configurations, run the Power Pages Site Checker from the Power Platform admin center. Select your site, then under Site Health choose Site Checker and select Run. Review the security diagnostic named "Anonymous access to Dataverse tables", which fails when one or more table permissions allow anonymous users to access Dataverse data.
To remediate affected configurations and safely re-enable only what is needed, we recommend:
This release will be applied to your Power Pages website(s). During the update, the Portal Management page in the Power Platform admin center will be placed in a read-only state for a short period of time. Additionally, your Power Pages website(s) will be restarted once during this upgrade.
More information, please visit:.
Maintenance window end for Non-Production Environments: August 12, 2026, at 3:00 AM UTC
Maintenance window start for Production Environments: August 12, 2026, at 6:00 PM UTC
Maintenance window end for Production Environments: August 13, 2026, at 3:00 AM UTC
The Power Pages hotfix release 9.8.7.x will contain security enhancements for the Webapi and Entity List Search and Anonymous Web API Access.
To prevent unintended, overly permissive permissions from causing broader data disclosure risks, the * wildcard can no longer be used with the Webapi/{table}/fields site setting for anonymous access to system tables.
The following system tables that will no longer allow anonymous access through the WebAPI with * wildcard in site setting Webapi/{table}/fields: contact, systemusers, account, annotation, lead, incident, opportunity, salesorder, queue, task, businessunit, team, quote, invoice, product etc.
What action do I need to take?
To identify if you have affected configurations, run the Power Pages Site Checker from the Power Platform admin center. Select your site, then under Site Health choose Site Checker and select Run. Review the security diagnostic named "Anonymous access to Dataverse tables", which fails when one or more table permissions allow anonymous users to access Dataverse data.
To remediate affected configurations and safely re-enable only what is needed, we recommend:
- Reviewing Web API-enabled tables and replacing the site setting Webapi/{table}/fields = * with an explicit list of only the comma separated required columns.
- Reviewing table permissions and applying the principle of least privilege by replacing Global access with narrower scopes such as Contact, Account, or Self where appropriate.
- Removing the Anonymous Users web role from permissions that do not require anonymous access.
- If there is no relevant scenario that requires anonymous access to these tables at all, we recommend blocking anonymous access completely, either by removing the Anonymous Users web role from the table permission or disabling Web API access for tables that do not require it by setting site setting Webapi/{table}/enabled to false.
This release will be applied to your Power Pages website(s). During the update, the Portal Management page in the Power Platform admin center will be placed in a read-only state for a short period of time. Additionally, your Power Pages website(s) will be restarted once during this upgrade.
More information, please visit:.
Change history
- 2026-08-07 · Created · All