Manage Website Security

The Power Platform Admin Center provides a centralized security dashboard for monitoring and managing Power Pages websites. Administrators can review Web Application Firewall status, monitor authentication providers, track SSL certificate expirations, manage website authentication keys, and analyze security checks across all websites.

By regularly reviewing security insights and recommendations, organizations can strengthen website protection, improve compliance, and reduce security risks.

Access Website Security Monitoring

Navigation:
Power Platform Admin Center → Power Pages → Security

The security dashboard provides visibility into security-related configurations and alerts across all Power Pages websites.

Web Application Firewall Disabled

This security indicator displays the number of production websites where Web Application Firewall (WAF) protection is disabled.

Identify websites without WAF protection.
Review production sites with security gaps.
Enable WAF to protect against common web attacks.
Improve overall website security posture.

Security Recommendation: Enable Web Application Firewall on all production websites to help protect against malicious traffic, exploits, and common web vulnerabilities.

External Authentication Enabled

This section shows websites that allow external authentication providers other than Microsoft Entra ID to access Dataverse data.

Review external identity providers.
Monitor authentication configurations.
Validate access requirements.
Ensure compliance with security policies.

Renew Website Authentication Key

The dashboard identifies production websites with expired authentication keys or keys that will expire within the next 90 days.

Monitor authentication key status.
Review upcoming expirations.
Renew keys proactively.
Prevent service disruptions.

Best Practice: Renew authentication keys before expiration to ensure uninterrupted access and maintain website security.

Renew SSL Certificates

SSL certificate monitoring helps administrators maintain secure HTTPS communications and prevent certificate-related issues.

Track certificate expiration dates.
Identify certificates expiring within 90 days.
Renew certificates before expiration.
Maintain user trust and secure communication.

Best Practice: Schedule SSL certificate renewals in advance to avoid security warnings and website downtime.

Site Security Checks

Site Security Checks provide a comprehensive overview of security assessment results across all websites.

Result	Description
Passed	Security check completed successfully.
Failed	Security issue requires immediate attention.
Warning	Potential security concern identified.
Not Run	Security check has not been executed.

Authentication Providers

The Authentication Providers section lists all identity providers configured across your Power Pages websites and displays the number of websites using each provider.

Review configured identity providers.
Identify provider usage across websites.
Select Review to see websites using a provider.
Validate authentication strategy and compliance.

Sites with Integrations

The Integrations dashboard displays services connected to your Power Pages websites and shows how many websites use each integration.

Power BI integrations.
SharePoint integrations.
Cloud Flows.
Payment providers.
Authentication services.
Security-related integrations.

Select Review to view websites using a specific integration and coordinate with site owners to remove unused or unnecessary services.

Governance Tip: Periodically review integrations and remove unused services to reduce security risks and simplify administration.

Benefits of Website Security Monitoring

Centralized security visibility.
Proactive risk management.
Improved compliance monitoring.
Authentication governance.
Certificate lifecycle management.
Enhanced website protection.
Reduced security vulnerabilities.

Best Practices

Enable WAF on all production websites.
Review security dashboards regularly.
Renew SSL certificates before expiration.
Renew website authentication keys proactively.
Validate external authentication providers.
Remove unused integrations.
Investigate failed security checks immediately.

Key Takeaways

Monitor WAF status and security posture from a centralized dashboard.
Track SSL certificates and authentication key expirations.
Review authentication providers and integrations.
Use security checks to identify risks and vulnerabilities.
Strengthen governance and compliance across Power Pages websites.