Zsolt Zombik

Posted on Apr 1

Power Pages Authentication Methods: The Complete Guide (2026)

#azure #microsoft #security #tutorial

"Wait, why are we storing passwords in Dataverse? Don't we have Azure AD?"

The question came from a security auditor during a partner portal review. I watched the project lead shift uncomfortably in their chair. The portal had been live for six months. Hundreds of external partners were logging in daily. And suddenly, we were all wondering the same thing.

The answer? It's complicated. And it revealed something I see far too often: teams building Power Pages portals don't fully understand the five authentication methods Microsoft provides — and most choose the wrong one.

The Problem With Power Pages Authentication

Microsoft Power Pages is brilliant for building external-facing portals quickly. Customer dashboards, partner collaboration sites, employee self-service pages — all built on top of Dataverse with low-code tools. It's fast. It's powerful.

But here's where it gets tricky: authentication.

The moment you add user-restricted content, you need to answer a critical question: How will your users prove who they are?

Power Pages gives you five distinct authentication methods:

Local Authentication (ASP.NET Identity) — username/password stored in Dataverse
OpenID Connect (OIDC) — modern federated authentication with Azure AD B2C or Entra ID
SAML 2.0 — enterprise-grade federation with ADFS, Okta, Ping Identity
OAuth 2.0 Social Login — "Sign in with Google/Microsoft/LinkedIn"
Open Registration — self-service account creation with invitation codes

Each has a different protocol, trust model, configuration complexity, and risk profile. Choose poorly, and you're looking at:

Account takeovers
Regulatory compliance failures
Phishing vulnerabilities
A painful (and expensive) re-architecture later

What I Wish Someone Had Told Me Three Years Ago

After that security audit, I spent weeks digging through Microsoft Learn documentation, OASIS specifications, IETF RFCs, and trial-and-error testing. I wanted to understand not just how each method worked, but when to use it and what security risks came with it.

Here's what I learned:

Local Authentication: Microsoft Says "Migrate Away From This"

The built-in username/password system stores credentials directly in Dataverse contact records. It's convenient for proof-of-concept work, but Microsoft explicitly recommends migrating to Azure AD B2C for production.

Why?

Email-only 2FA (not phishing-resistant)
No Conditional Access integration
Weak password policies by default (no uppercase/digit requirements out of the box)
If IsDemoMode is accidentally left True in production, OTP codes are displayed in the UI — catastrophic

When to use it: Rapid prototyping, internal demos, transitional scenarios

When NOT to use it: Any portal with regulated data (GDPR, HIPAA, PSD2)

OIDC: The Modern B2C Solution

OpenID Connect integrates with Azure AD B2C or Entra ID. It's the modern federated approach.

Key advantage: Conditional Access policies enforced at the identity provider level — device compliance, location-based restrictions, risk-based authentication

Security gotcha: By default, Power Pages uses the code id_token flow with form_post response mode. This exposes the ID token in the browser. For better security, switch to authorization code flow with PKCE.

Best for: Customer-facing portals (B2C scenarios)

SAML 2.0: Enterprise-Grade Federation

SAML is the gold standard for partner portals and B2B scenarios. It integrates with corporate identity systems like ADFS, Okta, and Ping Identity.

Key advantages:

Phishing-resistant (with proper configuration)
POST binding keeps tokens out of browser history
Single Logout (SLO) support
Group/role claims mapping for access control

Critical configuration: Set WantAssertionsSigned = True. Don't just validate the response envelope — validate the assertions themselves.

Best for: Enterprise/partner portals, B2B scenarios

Social OAuth: Convenience vs. Security

Let users sign in with their existing Google, Microsoft, LinkedIn, Facebook, or Twitter accounts.

When it makes sense: Consumer communities, public-facing portals where user convenience matters more than enterprise security.

What you give up: No enterprise MFA enforcement, minimal role claims, no Single Logout

Best for: Consumer-facing portals, community sites

Open Registration: Controlled Onboarding

Not an authentication protocol — it's a registration workflow. Users can create accounts with or without invitation codes.

Critical settings:

OpenRegistrationEnabled = False for enterprise portals
CaptchaEnabled = True if any self-registration is allowed
ResetPasswordRequiresConfirmedEmail = True (not the default!)

The Comparison Table You Actually Need

I built a side-by-side comparison table covering:

External IdP requirements
Enterprise MFA enforcement
Phishing resistance
Token visibility in browser
Group/role claims
Single Logout support
Regulatory compliance fit
Microsoft's recommendations
Setup complexity

It answers the question I had during that audit: "Which one should I actually use?"

The Real Answer to That Auditor's Question

Back to that security audit. Why were we storing passwords in Dataverse when we had Azure AD?

Because the team didn't realize they had better options. They saw "authentication" in the Power Pages setup wizard, clicked a few checkboxes, and moved on.

They didn't know:

Local auth is deprecated for production
SAML 2.0 would have leveraged the existing corporate identity system
Conditional Access policies could have been enforced automatically
Password rotation, MFA, and account lockout policies were already managed in Azure AD

The migration took three weeks, cost the project budget, and delayed the v2 roadmap. All because of an authentication decision made in the first sprint.

What I Built

I wrote the guide I wish had existed three years ago: a complete technical breakdown of every Power Pages authentication method with:

✓ Step-by-step protocol flows — understand exactly what happens during login

✓ Security configuration tables — every critical setting with defaults and recommendations

✓ Risk analysis — real-world security scenarios and how to mitigate them

✓ When to use each method — and when to absolutely avoid it

✓ Side-by-side comparison — answer "which one?" with confidence

Whether you're wiring up your first portal, designing an enterprise solution, or preparing for a security audit, this guide has the depth you need.

Read the Full Guide

The complete technical breakdown is here:

Power Pages Authentication Methods: The Complete Guide (2026)

It covers every authentication method in detail — local auth, OIDC, SAML 2.0, social OAuth, and open registration — with configuration examples, security best practices, and decision frameworks.

DEV Community