Power Pages builds an external portal directly on Dataverse, the same data platform used by Dynamics 365 and Power Apps. Security rests on three layers: authentication through an identity provider, web roles that control who sees which pages, and table permissions that control which customer sees which records. As a result, each customer sees only their own cases, documents and orders, without building an API layer and user management from scratch.
What a Power Pages customer portal can do
- A personal area with customer details, orders and documents.
- Opening service requests and tracking their status.
- Dynamic forms with file attachments.
- Digital signature of documents.
- Payment through a payment provider.
- Content, FAQs and help articles.
The three layers of security
1. Authentication
Sign-in through Microsoft Entra External ID or Azure AD B2C, with a one-time code or a password, and, where needed, organizational sign-in or social accounts.
2. Web roles
Web roles determine which pages and areas each type of user sees: customer, supplier or agent.
3. Table permissions
Table permissions determine which records a user sees and what they are allowed to do with them, by contact, by account or by a relationship between records. This is what ensures a customer sees only their own cases.
On top of these, we add protections such as a Web Application Firewall, CAPTCHA on public forms and security testing before go-live.
Power Pages or full custom development?
| Power Pages | Full custom development | |
|---|---|---|
| Time to go-live | Shorter: the data, permissions and users already exist | Longer: you build an API layer, users and permissions |
| Security model | Built in: web roles and table permissions | Built and maintained in code |
| Connection to Dynamics 365 | Direct, on the same Dataverse | Through an API |
| Design freedom | Broad, within the platform's framework | Complete |
| Ongoing cost | Licensing per authenticated user per month | Hosting and code maintenance |
Examples from our projects
Israel Aerospace Industries (IAI) · the iCare portal: a Power Pages customer portal on Dynamics 365, with service requests, shipments and technical literature.
Reichman University · Dormitories: registration, payment through PayPlus and a digital contract, all in one portal connected to the CRM.
The Histadrut (Israel's General Federation of Labor) · New employee portal: an external portal with Azure B2C authentication, documents for signature and a personal area.
Limitations and considerations
- Licensing is calculated per authenticated user per month. For a portal with many users, calculate the cost in advance.
- A very rich experience, or a design that goes far beyond the framework, may justify full custom development.
- A lot of custom client-side code hurts performance. It is better to rely on the built-in capabilities.
- Accessibility and right-to-left layout must be tested as part of the project, according to Israeli Standard IS 5568 (Israel's web accessibility standard, based on WCAG).
Frequently asked questions
Can a customer see only their own data?
Yes. Table permissions restrict each user to the records related to them, by their contact or by their account.
What sign-in options are available?
Microsoft Entra External ID or Azure AD B2C, with a one-time code or a password, and, where needed, organizational sign-in or social accounts.
Can the portal collect payments?
Yes, through a connection to a payment provider. In the Reichman University dormitories portal, payment is processed through PayPlus.
Can the portal connect to SAP or Priority ERP?
Yes, through Power Automate or Azure services, including systems that run on-premises.
Does Power Pages support Hebrew?
Yes, including right-to-left layout. Accessibility needs to be adapted and tested as part of the project.
Founder & CEO of Zooz-tech, solutions architect, Microsoft 365 Architect Expert.