New Authentication Governance Controls in Power Pages

We’re excited to announce the public preview of new authentication governance controls in Power Pages. Administrators can now allow or block individual authentication protocols, supported OAuth 2.0 identity providers, and local authentication from the Power Platform admin center (PPAC).

Organizations need to keep authentication choices aligned with their security requirements while supporting the different sign-in needs for citizen, customer, employee, and partner portals. Previously, administrators could only allow or block external authentication. With these new controls, they can now allow external authentication while blocking specific protocols, supported OAuth 2.0 identity providers, or local authentication.

What’s new

• Protocol-level controls let admins allow, or block OpenID Connect, SAML 2.0, WS-Federation, and OAuth 2.0.
• OAuth 2.0 provider controls let admins independently allow or block Google, Microsoft, and Facebook identity providers.
• Local authentication controls let admins restrict sign-in using locally stored usernames and passwords.

Why this matters

• Centrally manage authentication choices. Administrators define which options are available for makers to configure, rather than relying on each site team to apply authentication restrictions independently.
• Support different business requirements. Site targeting lets administrators apply restrictions broadly while allowing a different option for selected sites that need it.
• Make restrictions clear to makers. Blocked protocols and identity providers appear greyed out in Power Pages design studio, with a message explaining that the administrator has disabled the option.

For example, an enterprise uses OpenID Connect for its customer portals, but a partner portal needs SAML 2.0 to support a partner’s identity provider. An administrator can allow SAML 2.0 only for that partner portal while keeping it unavailable on the other sites in the environment. The administrator can also block local authentication across production sites so users sign in through an external identity provider rather than locally stored accounts.

Administrators decide which authentication options are allowed; makers then configure sign-in for each site using those permitted options. Allowing a protocol lets makers configure any identity provider that uses that protocol. For example, allowing OpenID Connect lets makers set up Microsoft Entra External ID, but it doesn’t prevent them from choosing a different OpenID Connect provider.

How to get started

You must have the Power Platform Administrator or Dynamics 365 Administrator role to configure these controls.

1. Sign in to the Power Platform admin center.
2. Go to Manage > Products > Power Pages, and select Settings.
3. Under Authentication, select the option you want to manage.
4. Select an environment, select Manage, and choose the sites where the option is allowed.
5. Review the affected sites and confirm the update.

Site owners and administrators are notified by email when a control is applied or updated.

Note: As earlier, all authentication options are allowed by default unless an administrator restricts them. Allowing an option makes it available for makers to configure; it doesn’t enable authentication or set up an identity provider.

Important:

These restrictions apply even if a site already uses the authentication option you’re blocking. Users will no longer be able to sign in or register with that method. Before applying the restriction, work with site owners to make sure another sign-in method is configured and available to affected users. Before you confirm the change, the admin center lists the affected sites based on your selection and warns about the impact on live sites and users.

Learn more

See Use governance controls to manage site authentication for configuration guidance, control dependencies, and additional scenarios.

We’d love to hear your feedback! Share your thoughts in the Power Pages community forum.

The post New Authentication Governance Controls in Power Pages appeared first on Microsoft Power Platform Blog.