Previously, external sign-in had an all-or-nothing switch. Now an administrator can keep it on while turning off an individual protocol, social login, or local usernames and passwords. Changes can also affect sites that are already live.
What is new
- Protocol controls: allow or block OpenID Connect, SAML 2.0, WS-Federation and OAuth 2.0.
- Provider controls: allow or block the Google, Microsoft and Facebook OAuth 2.0 identity providers one by one.
- Local authentication control: allow or block sign-in with locally stored usernames and passwords.
- Site targeting: apply a control to all sites in an environment, all except some, only selected sites, or none.
Taken from the official update: microsoft.com [1]
Where the controls live and who can change them
These settings are in the Power Platform admin center, not the site editor. An administrator selects Manage, then Products, Power Pages, Settings, and Authentication. Changing the settings requires the Power Platform Administrator or Dynamics 365 Administrator role, so makers without either role cannot change them.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2], microsoft.com [1]
Microsoft's documentation displays the Authentication page, just like the main image above. One group includes external authentication protocols and identity providers, listing Google, Microsoft and Facebook under OAuth 2.0. The other group includes local authentication. Both groups are marked Preview.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2]
External authentication is a parent control. Protocols and local authentication can be used only when it is allowed, and the Google, Microsoft and Facebook controls also require OAuth 2.0 to be allowed. Blocking a parent makes its options unusable, so plan the order of changes.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2], microsoft.com [1]
What makers and site owners will see
In Power Pages design studio, protocols or providers blocked by governance appear dimmed and cannot be configured. Selecting one displays a message saying the administrator disabled it and advising you to choose another provider or protocol. A note at the top of the identity providers page also says some providers are disabled and advises contacting your administrator.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2]
When an administrator applies or updates a control, Microsoft emails the site owner and administrator with a description of the change and a suggested action. Before the administrator saves, the admin center shows the affected sites and warns that live sites and users may be affected, so the change should not be a complete surprise.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2]
The administrator's setting alone determines this. Makers cannot configure a blocked option in design studio, and users can no longer sign in or register with a blocked method, even on sites already using it. The documentation recommends confirming that affected users have another way to sign in first.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2]
What the controls cannot do
Allowing an option makes it available for makers to configure, but does not turn on authentication or set up an identity provider.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2]
The protocol controls apply broadly. Allowing OpenID Connect makes all OpenID Connect providers available, including Microsoft Entra External ID, and makers can configure additional providers. As a result, these controls cannot restrict makers to a single OpenID Connect provider. Google, Microsoft and Facebook are exceptions, since each can be allowed or blocked individually.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2], microsoft.com [1]
These controls extend the older allow or block switch for external authentication. Any tenant level setting configured earlier remains in place.
Fact checked on 9 Nov 2026 against microsoft.com [1]
What the official notes do not say
- The announcement and the linked guidance do not name eligible product plans or SKUs, a price, or a required product version.
- They mark the feature as public preview but give no general availability date and no more specific rollout schedule.
- They give no numeric limits, such as a maximum number of environments or sites.
How it helps: an IT administrator for a membership organization whose member portals offer Google, Microsoft and Facebook sign-in
The task. Disable Facebook sign-in only, while keeping Google and Microsoft
- Open the Power Platform admin center with a Power Platform Administrator or Dynamics 365 Administrator role.
- Go to Manage, Products, Power Pages, Settings, then Authentication.
- Check that external authentication and OAuth 2.0 are allowed, because the Google, Microsoft and Facebook controls depend on them.
- Open the Facebook control and choose the target that fits: all sites, all except selected sites, selected sites only, or none of the sites. To remove Facebook everywhere, choose none of the sites.
- Before saving, review the list of affected sites and read the warning that live sites and users might be affected.
- Confirm with site owners that Facebook users have another way in, such as the Google or Microsoft provider, then save.
The result. Facebook is dimmed in design studio, with a message saying the administrator disabled it. Site owners and the administrator receive an email explaining the change. Google and Microsoft remain available.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2], microsoft.com [1]
Other ways to use it
Allow SAML 2.0 only for the selected sites, so the partner portal retains it while other sites do not offer it.
Fact checked on 9 Nov 2026 against microsoft.com [1], learn.microsoft.com [2]
If a client's administrator blocks a login, it will appear dimmed in design studio with a message saying the administrator disabled it. Before quoting a sign-in method, ask which protocols and providers are allowed for the site, including Google, Microsoft and Facebook, and which sites the controls apply to.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2], microsoft.com [1]
When an administrator blocks local authentication, users can no longer register or sign in with it. You should receive an email about the change. Before the block takes effect, make sure another sign-in method is configured and permitted for your site.
Fact checked on 9 Nov 2026 against learn.microsoft.com [2]
Related nvudev guides
Sources
- https://www.microsoft.com/en-us/power-platform/blog/power-pages/new-authentication-governance-controls-in-power-pages/ (official update)
- https://learn.microsoft.com/en-za/power-pages/security/external-auth-control
Facts in this article were checked against these sources on 9 Nov 2026. Product details change, so check the official page before you rely on them.