MWPRO IMPACT SCORE
OPERATIONAL IMPACT
66
0
25
50
75
100
HIGH IMPACT • REVIEW RECOMMENDED
Recommended Action:
Review the update and plan any required actions before rollout.
Review the update and plan any required actions before rollout.
What is MWPro Impact Score?
Watch our 60‑second explainer
Primary Audience
Power Platform AdminsIT ManagersSecurity TeamsCompliance TeamsService OwnersDevelopers
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
This hotfix enforces tighter security controls by removing wildcard support for anonymous Web API access and certain Dataverse system tables. Admins must review site settings, adjust permissions, and potentially remove anonymous access roles to comply. The change involves detailed configuration and governance work, but downtime and user disruption are minimal beyond brief restarts.
82
Admin Impact
20
User Impact
75
Urgency
68
Effort
WHAT YOU NEED TO KNOW
AT A GLANCE
Power Pages hotfix adds security changes to Web API and anonymous access. Sites using wildcard settings need review before the update.
END USERS
Sites may restart once during the update; brief read-only state in admin centre.
IT ADMINS
Run Site Checker and review table permissions, replace wildcard access and restrict anonymous roles before rollout.
ROLLOUT TIMELINE
Upcoming:
Starts 11 Aug 2026
Starts 11 Aug 2026
📢 Official Microsoft Message Center Announcement
Power Pages – Power Pages version 9.8.7.x Hotfix Release
Message ID: MC1449976
Maintenance window start for Non-Production Environments: August 11, 2026, at 6:00 PM UTC
Maintenance window end for Non-Production Environments: August 12, 2026, at 3:00 AM UTC
Maintenance window start for Production Environments: August 12, 2026, at 6:00 PM UTC
Maintenance window end for Production Environments: August 13, 2026, at 3:00 AM UTC
The Power Pages hotfix release 9.8.7.x will contain security enhancements for the Webapi and Entity List Search and Anonymous Web API Access.
To prevent unintended, overly permissive permissions from causing broader data disclosure risks, the * wildcard can no longer be used with the Webapi/{table}/fields site setting for anonymous access to system tables.
The following system tables that will no longer allow anonymous access through the WebAPI with * wildcard in site setting Webapi/{table}/fields: contact, systemusers, account, annotation, lead, incident, opportunity, salesorder, queue, task, businessunit, team, quote, invoice, product etc.
What action do I need to take?
To identify if you have affected configurations, run the Power Pages Site Checker from the Power Platform admin center. Select your site, then under Site Health choose Site Checker and select Run. Review the security diagnostic named “Anonymous access to Dataverse tables”, which fails when one or more table permissions allow anonymous users to access Dataverse data.
To remediate affected configurations and safely re-enable only what is needed, we recommend:
- Reviewing Web API-enabled tables and replacing the site setting Webapi/{table}/fields = * with an explicit list of only the comma separated required columns.
- Reviewing table permissions and applying the principle of least privilege by replacing Global access with narrower scopes such as Contact, Account, or Self where appropriate.
- Removing the Anonymous Users web role from permissions that do not require anonymous access.
- If there is no relevant scenario that requires anonymous access to these tables at all, we recommend blocking anonymous access completely, either by removing the Anonymous Users web role from the table permission or disabling Web API access for tables that do not require it by setting site setting Webapi/{table}/enabled to false.
This release will be applied to your Power Pages website(s). During the update, the Portal Management page in the Power Platform admin center will be placed in a read-only state for a short period of time. Additionally, your Power Pages website(s) will be restarted once during this upgrade.
More information, please visit:
- Use governance controls to disable anonymous access
- Set table permissions in Power Pages
- Overview of the Power Pages portals Web API
- Upgrade a Power Pages site
Source: Microsoft Message Center • Analysed by MWPro
