Site visibility in Power Pages

Article
11/03/2023

The Power Pages site visibility setting allows you to control who has access to your website. You can make the site private to restrict access to specific people in your organization. If you choose to make the site public, anyone with the link can access it.

Animation that shows site visibility setting change from private to public.

Important

All sites that you create in Power Pages are private by default.
Site visibility is only available for websites that were created with version 9.4.9.x or later.
Be cautious when you edit a public site. Changes are visible to external users immediately.
Websites in developer environments can't be made public.

Difference between a private site and a public site

Only site makers and organization users to whom the maker granted access can view private sites. Site visitors need to authenticate with the organization's Microsoft Entra ID identity provider before they can view site contents.

Tip

Set visibility to private to limit access while your site is in development.

Anyone on the Internet can view public sites anonymously or if they're authenticated with an identity provider. Public websites are production sites, fully operational for customers to use. A notification reminds you when you edit a public site in the design studio, Portal Management app, Visual Studio Code editor, and the Microsoft Power Platform CLI.

Change site visibility

When a site is ready to go live, you can set the site visibility to public. You can change the site visibility back to private at any time so that only the makers of the site and selected users have access.

When you change the site visibility, your website restarts. It may take a few minutes to reflect the last change.

Sign in to Power Pages and edit your site.
In the left side panel, select Set up in the list of workspaces.
In the Security section, select the Site visibility tab.
Select Public or Private.

If you used Power Apps to create your site, follow these steps instead:

Sign in to Power Apps
Select Apps, and then select your site.
Select More Commands (…) > Edit.
Select Open in Power Pages.
In the left side panel, select Set up in the list of workspaces.
In the Security section, select the Site visibility tab.
Select Public or Private.

Grant access to a private site

When your site is private, you can use the site visibility page to grant access to other organization users. You can grant access to up to 50 organization users. You don't need to grant access to users who have the System administrator role in your site's environment. They have permissions to view the site by default.

Sign in to Power Pages and edit your site.
In the left side panel, select Set up in the list of workspaces.
In the Security section, select the Site visibility tab.
Enter the names or email addresses of the users you want to grant access to.
Select Share.

Note

Users who are granted access to a private site aren't automatically authenticated on the site. Learn how to provide access to external audiences.

Permissions required to change site visibility

Your security role and tenant security settings determine whether you can change a site's visibility.

Service admins who are members of any of the following Microsoft Entra roles can change the site visibility:

When the tenant-level setting enableSystemAdminsToChangeSiteVisibility is set to true, members of the System administrator security role can also change the site visibility.

If the tenant-level setting enableSystemAdminsToChangeSiteVisibility is set to false, members of the System administrator security role must be a member of an exclusive security group in Microsoft Entra that has the permissions to manage site visibility.

Change the tenant-level setting

You can use a PowerShell script to change the tenant-level setting enableSystemAdminsToChangeSiteVisibility.

Important

Effective October 1, 2023, system administrators can't change site visibility when the tenant-level setting is null. Set the value for enableSystemAdminsToChangeSiteVisibility to either true or false.

To get the current value of the tenant-level setting, use the Get-TenantSettings command. For example:

$myTenantSettings = Get-TenantSettings
$ myTenantSettings.powerPlatform.powerPages

Note

The Get-TenantSettings command doesn't list tenant settings whose value is null. The default value of the tenant-level setting enableSystemAdminsToChangeSiteVisibility is null, so it doesn't appear the first time you run the script. After you set its value to true or false, the setting appears in the list.

To set a value for enableSystemAdminsToChangeSiteVisibility, use the Set-TenantSettings command. The following example sets the value to false:

$requestBody = @{
    powerPlatform = @{
        powerPages = @{
            enableSystemAdminsToChangeSiteVisibility = $false
        }
    }
}
Set-TenantSettings -RequestBody $requestBody

Delegate site visibility control

When you don't want all system administrators to be able to change site visibility, set enableSystemAdminsToChangeSiteVisibility to false. Then delegate site visibility management to a select set of users.

Add system administrators to a security group in Microsoft Entra ID and give the group site visibility permissions.
In the Power Platform admin center, select Power Pages sites.
Select your website, and then select Manage.
In the Security section, select Manage site visibility permissions.
Add the security group that includes the specific system administrators you want to delegate site visibility control to.

After you add the security group, all system administrators who are in the group can manage site visibility. System administrators who aren't members of the group see the site visibility section disabled.

Known issues

Microsoft Entra authentication is turned on by default when a website is provisioned. A private Power Pages website doesn't work if you turn off Microsoft Entra authentication. Change the site visibility to public before you turn off Microsoft Entra authentication.