Roles Required for Website Administration in Power Pages
Roles Required for Website Administration in Power Pages
Power Pages administration requires different roles and permissions depending on the task being performed. Some administrative actions require Microsoft 365 administrative privileges, while others depend on Power Platform security roles or Microsoft Entra application ownership.
Understanding these role requirements helps administrators manage websites securely and ensures users have the correct permissions to perform administrative operations.
Required Roles and Permissions
| Task | Required Roles |
|---|---|
| Add Custom Domain | Website Owner, System Customizer, System Administrator, Dynamics 365 Administrator, or Power Platform Administrator |
| Update Dynamics 365 Instance | Website Owner, System Customizer, System Administrator, Dynamics 365 Administrator, or Power Platform Administrator |
| Manage Authentication Key | Website App Owner plus any supported administrator role |
| Convert to Capacity Model | Website App Owner plus any supported administrator role |
| Convert Trial to Production | Website App Owner plus any supported administrator role |
| Create a Website | Read-Write Access Mode, System Administrator, and Microsoft Entra App Registration permissions |
Dynamics 365 Administrator
The Dynamics 365 Administrator role is a Power Platform service administrator role that provides full system administration capabilities for Dynamics 365 and Power Platform environments.
Assignment Method:Microsoft 365 Admin Center → Users → Active Users → Assign Service Admin Role
Global Administrator
The Global Administrator role is the highest Microsoft 365 administrative role and provides complete control over subscriptions, services, and organizational resources.
- Full Microsoft 365 administration access.
- Manage users and licenses.
- Configure tenant-wide settings.
- Access most organizational resources.
Website App Owner
The Website App Owner is the owner of the Microsoft Entra application associated with the Power Pages website.
Navigation:Azure Portal → Microsoft Entra ID → App Registrations → Portals-SiteName → Owners → Add Owner
This role is required for tasks involving authentication keys, licensing conversions, and website ownership-related administration.
Website Owner
The Website Owner is the user who originally created the Power Pages website. Website ownership cannot be transferred to another user.
Important: Website ownership is assigned when the site is created and cannot be changed later.Read-Write Access Mode
Users creating websites must have their Power Platform Access Mode configured as Read-Write.
- Create and manage records.
- Access Dataverse resources.
- Perform website administration tasks.
- Support environment management operations.
System Administrator
The System Administrator role provides full control over Power Platform environments and Dataverse resources.
- Manage environment settings.
- Configure security roles.
- Create and manage websites.
- Administer Dataverse resources.
System Customizer
The System Customizer role provides extensive customization permissions while limiting some administrative capabilities.
- Customize Dataverse tables.
- Modify forms and views.
- Manage website configurations.
- Create business applications.
Power Platform Administrator
The Power Platform Administrator role provides broad administrative capabilities across Power Platform services and environments.
- Manage environments.
- Monitor platform resources.
- Administer Power Pages websites.
- Configure tenant-wide settings.
Role Assignment Limitation
Microsoft Graph currently does not return role assignments that are granted through security groups.
Limitation: Assign administrative roles directly to users instead of relying solely on security group assignments when managing Power Pages administrative permissions.Best Practices
- Apply the principle of least privilege.
- Assign administrative roles only when required.
- Review role assignments regularly.
- Use Microsoft Entra ID ownership management for application administration.
- Monitor administrative activities and access permissions.
- Document role assignment procedures.
Key Takeaways
- Different Power Pages administrative tasks require different roles.
- Website App Owner permissions are required for authentication and licensing operations.
- System Administrator and Power Platform Administrator roles provide broad administrative capabilities.
- Website ownership cannot be transferred after site creation.
- Assign roles directly to users for reliable administration and access management.