Security in Volunteer Management and Volunteer Engagement

Important

Microsoft is making Volunteer Management available through an open-source approach that nonprofits, partners, and communities can adapt and build on over time. Beginning February 1, 2027, Microsoft product engineering support for Volunteer Management will end, and Microsoft will no longer guarantee future maintenance, updates, or compatibility. The open-source code will remain available in a public GitHub repository.

The recommended path is to rebuild from the open-source assets, either with your current partner or another qualified provider. Start by documenting your current volunteer processes, deployment, plug-ins, signing keys, customizations, integrations, security needs, and dependencies, and then use the published migration guidance to plan and test the rebuilt solution. You may also use the Microsoft Business Applications partners list to find a partner. A partner-led offer might become available, but Microsoft can't guarantee an offer, timing, pricing, or availability for every customer or market.

Important

Microsoft is making Volunteer Engagement available through an open-source approach that nonprofits, partners, and communities can adapt and build on over time. Beginning February 1, 2027, Microsoft product engineering support for Volunteer Engagement will end, and Microsoft will no longer guarantee future maintenance, updates, or compatibility. The open-source code will remain available in a public GitHub repository. The recommended path is to rebuild from the open-source assets, either with your current partner or another qualified provider. Start by documenting your current volunteer processes, deployment, plug-ins, signing keys, customizations, integrations, security needs, and dependencies, and then use the published migration guidance to plan and test the rebuilt solution. You may also use the Microsoft Business Applications partners list to find a partner. A partner-led offer might become available, but Microsoft can't guarantee an offer, timing, pricing, or availability for every customer or market.

Volunteer Management and Volunteer Engagement are built on different platforms, so they're secured in different ways:

  • Volunteer Management is a model-driven Power Apps application that stores its data in Microsoft Dataverse. Staff inside your organization use it, and Dataverse security roles control access.

  • Volunteer Engagement is a Power Pages site that people outside your organization can reach. You control access by using site visibility, an identity provider, web roles, table permissions, and page permissions.

Because the two solutions share data but not their security models, review the guidance for each one separately. A control that you configure for one solution doesn't necessarily apply to the other.

This article lists the authoritative Microsoft guidance for each area. It doesn't replace the platform documentation, and it doesn't describe a configuration that's applied for you. You choose, configure, and validate the controls that fit your organization's risk profile and regulatory obligations.

Who's responsible for what

Security in the cloud is a shared responsibility. For the overall model that applies to Microsoft for Nonprofits, go to Security in Microsoft for Nonprofits.

Party Responsibility
Microsoft Secures and operates the underlying cloud platform and services, including Power Platform, Power Pages, Dataverse, and Azure.
Your organization Owns your data and your user identities. You decide which identity providers, permissions, retention, auditing, and monitoring settings to use, and you're accountable for keeping them correct over time.
Your implementation partner If a partner deploys or extends the solutions for you, they configure the settings you agree on. Accountability for the resulting configuration stays with your organization.

Deploying Volunteer Management or Volunteer Engagement doesn't by itself make an environment secure, and the controls described here aren't enabled automatically. Review and configure them as part of your deployment and your ongoing operations.

Secure Volunteer Management

Staff use Volunteer Management, and Dataverse security protects it.

  • Assign security roles: Volunteer Management includes one default security role, Volunteer Manager. Assign it to the staff who manage volunteers, and create more roles when you need finer-grained access. For more information, see Security roles and privileges and Assign security roles.

  • Apply least privilege: Grant only the privileges a role needs, and review role assignments, application users, and team memberships periodically. For more information, see Create or edit a security role.

  • Protect the environment: Environment-level controls such as Microsoft Entra Conditional Access, data loss prevention policies, and IP firewall apply to everyone who uses the app. For more information, see Power Platform security and governance documentation.

  • Review connected services: If you integrate SharePoint for volunteer documents, the permissions on the SharePoint site apply in addition to Dataverse permissions. For more information, see Set up SharePoint integration.

Secure Volunteer Engagement

Volunteer Engagement is a public-facing Power Pages site. So, it needs the extra controls that apply to external-facing websites. Start with Power Pages security, and use the Security workspace in the design studio to manage these settings.

  • Set site visibility: New sites are private and available only to users inside your organization. Change visibility to public only when the site is ready for volunteers. For more information, see Site visibility.

  • Configure authentication: Volunteers sign in through an identity provider that you select and configure. For more information, see Authentication in Power Pages.

  • Assign web roles: Web roles determine what authenticated and anonymous visitors can do. For more information, see Create and assign web roles.

  • Set table permissions: Table permissions control which Dataverse records the site can read or write through lists, forms, Liquid, and the Web API. Verify that volunteers can access only their own profile, applications, and engagement records. For more information, see Set table permissions.

  • Set page permissions: Page permissions restrict individual pages and components to specific web roles. For more information, see Set page permissions.

  • Run the security scan: The scan detects common issues such as cross-site scripting and insecure libraries, and suggests fixes. Rerun it after you customize the site. For more information, see Run security scan and Security issues in site checker.

  • Add a web application firewall: You can put a web application firewall (WAF) in front of the site for extra protection against common web attacks. Power Pages documents this setup with Azure Front Door, and you can use other WAF infrastructure instead. For more information, see Set up Azure Front Door with Power Pages sites.

For a deeper look at the platform's security architecture and hardening options, see the Power Pages security white paper.

Identity providers for volunteers

Power Pages supports several identity providers, including Microsoft Entra ID, Microsoft Entra External ID, and other OpenID Connect, OAuth 2.0, SAML 2.0, and WS-Federation providers.

Selecting and configuring an identity provider is your organization's responsibility. Base the choice on your own requirements, such as how your volunteers already sign in, the identity platforms and protocols your organization supports, and any regulatory obligations you're subject to. An implementation partner can configure the provider you choose, but the decision and the resulting configuration remain yours.

No provider is configured for you, and guidance written for one provider doesn't necessarily apply to another. Follow the setup and security guidance published for the provider you select.

Logging and auditing

Enable auditing and logging so that you can investigate who changed volunteer data and when.

Define who reviews these logs and how long you keep them, in line with your organization's retention and privacy commitments to volunteers.

  • Last updated on