When you build a portal in Power Pages, you usually secure your data by linking a record to the logged-in user through a Contact or Account relationship.
But what happens if a table doesn’t have that relationship?
Think about a support portal. You have a table for “Ticket Categories.” These categories are general reference data; they don’t belong to any specific user. Let’s say you want portal users see only categories for payments.
You want the form dropdown to only show the payment-related categories, while keeping options like “IT Support”, “HR” or even some categories with confidential data hidden because they are for internal staff only. Considering a scenario of a fully custom form developed using JavaScript and the Web API, you could use code and list only categories you want. But there is a catch.
In the past, you had to set the table permission to “Global” just so users could read the public options, which by default would allow read access in all the categories in the table.
And if you enabled that table for the Web API for any reason, users could easily browse all by finding the table address or running a GET request (even if your form does not explicitly expose any):
The Solution
There is now a built-in way to fix this. Power Pages introduced a new Custom access type (currently in Preview) for table permissions.
It lets you filter records using a FetchXML query. Instead of sending all the data to the browser and trying to hide it with code, the Custom access type filters the data inside Dataverse. It only sends the records you want the user to see. If someone tries to use developer tools or the portal Web API to find hidden categories, it won’t work because the data is blocked at the source.
How to set it up
Here is how you configure the “Custom access” table permission for our payment category example:
Turn on Enhanced Authorization: First, go to your Power Pages site settings in the Power Platform admin center and enable Enhanced Authorization:
This moves the permission checks directly into Dataverse, which is required for this feature to work.
Create the Custom Permission: When you create the Table Permission for your Categories table, look at the access type dropdown. Instead of picking Global, Contact, or Account, select Custom access (and also deactivate any previous table permission you used too)
Write your FetchXML: A text box will appear. Paste your FetchXML query here.
For our ticketing example, you just write a simple FetchXML query that filters the category table to only return the record where the name contains “Payment.”
<fetch>
<entity name="pnp_supportticketcategory">
<attribute name="pnp_name" />
<filter>
<condition attribute="pnp_name" operator="like" value="%payment%" />
</filter>
</entity>
</fetch>Save the permissions and refresh the cache. Next time you try to load the categories using the web API, or using a form to create a new record, you will see the limited list of categories:
That is it😁
Now the data is pre-filtered at source; no code is needed for this.
References
Power Pages Table Permissions – Custom Access Type – Microsoft Learn
Power Pages – Enable Enhanced Authorization – Microsoft Learn
