PL-900 — Session 3 — Power Pages

What is Microsoft Power Pages?

A secure, enterprise-grade, low-code Software as a Service (SaaS) platform for creating, hosting, and administering modern, external-facing business websites. Accessible to both low-code makers and professional developers. URL: powerpages.microsoft.com

Core Capabilities

Secure external websites

Create public or partner-facing portals with authentication and role-based access controls. Especially useful in healthcare and finance where sensitive data must be protected yet accessible to authorized users.

Dataverse integration

Collect and display Dataverse data using forms and lists, enabling real-time interaction with business data. Supports customer onboarding, service request tracking, and more.

Power Automate workflows

Trigger automated actions like approvals or notifications from form submissions — ideal for procurement or HR request processes.

Self-service portals

Users can submit requests, track cases, or update profiles without direct support, reducing operational overhead.

M365 & Azure integration

Seamless connectivity with SharePoint, Teams, and Entra ID for a cohesive digital environment.

Granular permissions

Web roles and table permissions ensure compliance and data protection across all site content.

AI & Copilot agents

Embed chatbots and AI assistants to guide users through complex processes and provide automated support.

Real-World Use Cases

Partner Collaboration

Manufacturing companies give suppliers a secure portal to access inventory data, update delivery timelines, and share logistics plans — replacing scattered emails.

Employee Self-Service

Staff independently access HR documents, submit leave requests, enroll in benefits, or complete training without relying on HR or management.

Customer Portals

Customers submit support tickets, track orders, or update account profiles without human intervention — improving satisfaction and reducing overhead.

Education

Faculty check payroll, submit professional development requests, or organize course schedules. Students access enrollment info via an AI agent.

Real Estate

Agents and brokers access shared property listings, marketing assets, and transactional details to collaborate and close deals faster.

Public Sector

Government employees access policy documents, submit expense claims, or register for workshops — simplifying previously manual processes.

Three Ways to Build a Site

Method	Best for	How it works
AI-powered Copilot	Non-developers wanting fast setup	Describe site purpose, users, and features in natural language. Copilot generates site name, address, homepage layout, and additional pages. Then refine in Design Studio.
Manual from scratch	Users wanting full control	Start with a blank canvas and design every detail to meet specific, unique requirements.
Developer / pro-code	Advanced scenarios needing custom code	Access tools like Visual Studio Code, GitHub, and Azure DevOps. Integrate custom APIs and advanced functionality beyond low-code scope.

Copilot Site Creation — 3 Steps

Describe

Input a natural language description of the site (e.g., "create a site for project management"). Copilot interprets the intent and generates a site structure.

Pick Layout

Copilot presents layout options aligned with the described use case. Choose the visual structure that best fits the need. Can regenerate for more options.

Add Pages

Specify initial pages to include (e.g., dashboard, contact forms, resource libraries). Common templates like About Us and FAQ are offered. Site is generated and opens in Design Studio.

Design Studio — 4 Workspaces

The central tool for customizing and managing a Power Pages site after creation. Click each workspace for details ↓

📄 Pages

Create, edit, and arrange web pages and site navigation

🎨 Styling

Theming, color palettes, fonts, buttons, branding

🗄️ Data

Connect to Dataverse, manage tables, forms, and views

⚙️ Setup

Site settings, performance, integrations, security

Pages workspaceCreate new pages, edit existing ones, organize site navigation. Add sections within pages and insert components like text, images, and forms. Includes a Navigation panel and a + Page button. Copilot integration: type a natural language prompt (e.g., "add a section with an image and a mission statement") and Copilot generates the section with a preview — you can accept, delete, or undo changes.

Styling workspaceApply global site styles aligned with corporate branding. Choose from multiple preset themes and customize: color palettes, background colors, font styles, button styles, and section margins. The Real-Time Preview feature shows changes instantly as you make them — no need to publish to see results.

Data workspaceSeamlessly integrate Dataverse into the site. Create new Dataverse tables, edit existing ones, and build or modify forms and views — all without leaving the site-building environment. Dataverse forms display lists of records or individual record details. Dataverse views enable data entry forms. Role-based security ensures only authorized users can access or modify data.

Setup workspaceCentralized hub for site configuration. Includes: Site Details (high-level config info), Go-Live Checklist (structured guide before launch), Site Performance tools (identify slow pages and get optimization suggestions), Integrations (connect Power Automate and external apps), and Copilot features like Site Search and Agent Configuration for intelligent user assistance.

7 Copilot Capabilities in Design Studio

1. Create & modify pages

Describe the page you need (e.g., "add a student registration page with a form and Submit button") — Copilot generates the layout, inserts the form, and connects it to the Dataverse table if needed.

2. Edit page content

Use natural language to update content (e.g., "change the title on the homepage to Welcome to the campus portal"). Copilot locates the block and applies the change.

3. Style & theme adjustments

Personalize appearance with prompts like "make all buttons rounded" or "use university blue and gold colors." Applied across the whole site via the Styling workspace.

4. Add data-driven components

Bind components to Dataverse tables — e.g., display maintenance requests from a facilities table. Ideal for operations or facilities management portals.

5. Configure security

Set web roles via natural language — e.g., "restrict grade submission pages to faculty only."

6. Generate forms automatically

Generate and embed forms tied to Dataverse tables (e.g., an IT support ticket form) with a single prompt.

7. Setup site navigation

Update navigation menus with prompts like "add a link to the student portal in the top navigation bar."

5 Security Principles of Power Pages

Multiple identity providers

Flexible login via Microsoft, LinkedIn, Google, or other third-party services. Configured in the Security workspace. Example: a corporate intranet restricts to Microsoft auth; a public event site allows LinkedIn login.

Role-based security

Users are assigned roles that define what data and features they can access. Essential for maintaining data integrity and compliance.

Table permissions

Granular control over Dataverse records — specify who can read, write, or delete data. Example: customers can only view their own order history, not others'.

Page permissions

Restrict access at the page level. Example: an admin dashboard is visible only to users with the Administrator role; general visitors see the public homepage.

Site visibility

Configure whether a site is public or private. A customer support portal can be open to all; an internal project management site can be restricted to employees only.

Layered Data Protection

Table permissions

Control access to Dataverse records
Read, write, delete per role
Example: users see only their own order history
Access types: global, local, self

Page permissions

Restrict which pages users can view
Assigned by web role
Example: payroll pages visible only to HR roles
Sensitive content stays hidden from general users

Identity Providers Supported

Provider	Best for	Example scenario
Microsoft (Entra ID)	Internal / employee portals	Corporate intranet restricting access to verified company accounts
LinkedIn	Partner / professional portals	Event registration site where professionals log in with existing credentials
Google	Public-facing / consumer portals	Customer service site where consumers log in with familiar credentials
Other third-party	Specialized audience needs	Custom OAuth providers for specific industry or regional requirements

Deep Scan & AI Responsible Use

The Deep Scan feature lets makers scan their site for vulnerabilities and receive guidance on how to fix them — especially valuable for public-facing sites with higher exposure to external threats. As Copilot becomes part of site creation, adopting responsible AI practices is emphasized to maintain ethical standards and content integrity. All security settings are managed through the centralized Security workspace.

Lab 3 — Contoso Event Management Site Hands-on

Build a Power Pages site for Contoso Consulting's event management system, using Copilot to generate the site and Design Studio to customize it. Builds on the Dataverse tables created in Lab 2.

Step-by-Step Summary

Generate site with Copilot

Navigate to powerpages.microsoft.com. Paste the Copilot prompt to describe the event management site. Set name to "Contoso Event Management" and URL to "eventmanagement." Click Next to pick a layout, then add pages (About Us, FAQ, and others). Click Done — site is generated and opens in Design Studio.

Customize the homepage

Upload the Contoso logo image to the header. Change the site background by uploading a background JPG from the GitHub lab assets. Use the Paintbrush panel for overlay, border, and layout adjustments.

Create Dataverse forms (Data workspace)

Open the Data workspace → Forms tab. Create two forms on the Event table: (1) "Create Event" — for adding new event records, and (2) "View Event" — for viewing records (includes a subgrid showing Active Event Sessions with Show Related Records enabled). Save and Publish both forms.

Build site pages (Pages workspace)

Create four new pages using Copilot: New Event (form mode: Create new record), View Event (form mode: Read-only), Edit Event (form mode: Update existing records), Events (list mode — displays Active Events with Create New Event, See Event, and Edit Event action buttons). Clean up extra sections on each page, keeping only the form and copyright footer.

Configure table permissions

Events page list: Permission name "Events," table = Event, access = Read, roles = Administrators + Anonymous + Authenticated. New Event page: table = Event, access = Read + Create, same roles. Edit Event page: table = Event, access = Read + Update, same roles.

Organize navigation & preview

Reorder pages: Events moved below Contact; New Event, View Event, and Edit Event nested as subpages under Events. Sync the site, then use Preview to see desktop and mobile views.

Forms Built in Lab 3 — Quick Reference

Form name	Table	Data mode	Page used on
Create Event	Event	Create new record	New Event page
View Event	Event	Read-only (+ Event Sessions subgrid)	View Event page
Edit Event (based on Create Event)	Event	Update existing records	Edit Event page

Permissions Configured in Lab 3

Permission name	Table	Access type	Roles assigned
Events	Event	Read (global)	Administrators, Anonymous, Authenticated
Create Events	Event	Read + Create	Administrators, Anonymous, Authenticated
Edit Event	Event	Read + Update	Administrators, Anonymous, Authenticated

Key Terms Flash Reference

Power Pages

Secure, enterprise-grade, low-code SaaS platform for creating external-facing business websites. Part of Microsoft Power Platform.

Design Studio

The central tool for customizing Power Pages sites. Contains four workspaces: Pages, Styling, Data, and Setup.

Table permissions

Granular controls over who can read, write, or delete Dataverse records in a portal.

Page permissions

Restrict access to specific pages based on user roles — sensitive pages are hidden from unauthorized users.

Web roles

The role assignments used in Power Pages to control what each type of user (admin, authenticated, anonymous) can see and do.

Site visibility

Setting that controls whether a site is public (open to anyone) or private (restricted to specific users).

Deep Scan

Feature that scans a Power Pages site for vulnerabilities and provides guidance on fixing them.

Go-Live Checklist

Structured guide in the Setup workspace ensuring all critical steps are completed before a site launches.

Subgrid

A component embedded in a form that displays related records from another table — e.g., showing Event Sessions inside a View Event form.

Click to reveal answers ↓

What are the four workspaces in the Power Pages Design Studio and what does each do?▼

Pages — create, edit, and arrange web pages and navigation. Styling — apply themes, color palettes, font styles, and branding with real-time preview. Data — connect to Dataverse, create and manage tables, forms, and views without leaving the site builder. Setup — configure site settings, performance tools, integrations (Power Automate), and Copilot features like Site Search and Agent Configuration.

What are the five security principles of Power Pages?▼

Multiple identity providers (Microsoft, LinkedIn, Google, etc.), role-based security (users assigned roles defining access), table permissions (granular Dataverse record access control), page permissions (restrict access to specific pages by role), and site visibility (configure whether a site is public or private).

What are the three ways to build a Power Pages site?▼

AI-powered Copilot (describe in natural language → Copilot generates name, address, layout, and pages → refine in Design Studio), manual from scratch (blank canvas, full control over every detail), and developer/pro-code (Visual Studio Code, GitHub, Azure DevOps for custom code and APIs beyond low-code scope).

What is the difference between table permissions and page permissions?▼

Table permissions control access to Dataverse records — specifying who can read, write, or delete data at the row level (e.g., a customer can only see their own orders). Page permissions restrict access to entire pages on the site based on web role — for example, an admin dashboard is only visible to users with the Administrator role, while other users are redirected to a public page.

What are the three Copilot site creation steps and what happens in each?▼

Describe — input a natural language description; Copilot generates a site structure based on your intent. Pick Layout — Copilot presents layout options matching your use case; choose the best fit (can regenerate for more options). Add Pages — specify which initial pages to include (e.g., About Us, FAQ, Contact); the site is generated and opens in Design Studio.

In the Lab 3 walkthrough, what three form modes were used and on which pages?▼

Create new record — used on the New Event page (lets users add a new event). Read-only — used on the View Event page (displays event details plus a subgrid of related Event Sessions). Update existing records — used on the Edit Event page (lets users modify an existing event record).

What is the purpose of the Events list page built in Lab 3?▼

The Events list page displays all active event records from the Dataverse Event table in a list view. It has three action buttons configured: Create New Event (opens the Create Event form to add a record), See Event (opens the View Event form to view details in read-only mode), and Edit Event (opens the Edit Event form to update an existing record). Table permissions are set so the data is readable by administrators, anonymous, and authenticated users.

How does Power Pages integrate with the broader Power Platform ecosystem?▼

Power Pages uses Microsoft Dataverse as its data backend, meaning data is shared across Power Apps, Power Automate, and Power BI. Power Automate can be triggered by form submissions on a Power Pages site (e.g., approvals, notifications). Power BI can be embedded in portal pages for data visualization. Entra ID (formerly Azure AD) handles authentication. The Design Studio's Setup workspace includes direct integration settings for Power Automate and external apps.