Hot SPA time machine in Power Pages

AI agent wrote, compiled, and deployed a full Dataverse plugin for George in under thirty minutes with DLL, custom API, pre/post steps and all, rendering him (George, that is) obsolete.  This aside, we cover the new caching improvements in server-side logic, whether Power Fx has any reason left to exist, and why SPA might be the most overloaded three letters in the Power Platform right now. Skip Cache: a new parameter on retrieve/retrieve multiple in server-side logic lets you bypass the 15-minute Dataverse cache. Still no built-in way to clear it programmatically and Nick Doelman's post from 5 years ago lives on. Is Power Fx dead in Power Pages? It never offered anything Liquid couldn't already do besides syntax sugar and a deployment headache. SPA support in Power Pages traces back further than you'd think: the old Customer Insights Journeys events portal. The real reason to host a SPA inside Power Pages instead of standing it up on its own. PCF vs. SPA A Power Pages plugin for GitHub Copilot CLI and Claude Code. The verdict: "We are definitely not the target audience." References Create and deploy a single-page application in Power Pages Build modern single-page applications Get started with the Power Pages plugin for GitHub Copilot CLI and Claude Code How server-side caching works in Power Pages Clearing the Dataverse cache with a dummy Web API update Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

Better late than never: we look back at what Microsoft put in the Power Pages section of the last-ever Power Platform release wave. The twice-yearly release-wave model is now being replaced by continuous updates on the AI at Work roadmap. So what was in the final wave? Server-side logic and client APIs reaching general availability, unified Power Pages and Dataverse authorization, AI coding tools that understand the platform, and Bootstrap 5 support for Dynamics 365 portal templates. We also discuss new CLI, analytics, authentication, and security capabilities and why steady delivery may matter more than one groundbreaking announcement. Along the way: impossible CAPTCHAs, YubiKeys, and why a SPA is an application pretending to be a website while a PWA is a website pretending to be an application. References One always-on roadmap: Dynamics 365, Power Platform, and Dataverse join the AI at Work roadmap New and planned features for Power Pages, 2026 release wave 1 Build Power Pages sites with AI using agentic coding tools Improve Power Pages security by activating Web Application Firewall independently Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

Power Pages is having a surprisingly good run. In this episode we dig into server-side logic debugging, the new client-side API, and why both feel about 15 years late yet still genuinely useful. We also look at Omar Zaarour's business-rules tool, Danish Naglekar's cross-platform Power Platform Toolbox, and George's Entra ID auto-clicker for making one of the most annoying prompts quietly disappear. References Power Pages Server Logic Debugging Guide | Microsoft Learn Code-only connectors Power Pages Client APIs Overview (preview) | Microsoft Learn Omar Zaarour's T365 Power Pages Business Rules Danish Naglikar's Power Platform ToolBox | Modern desktop companion - PPTB Entra ID Auto Confirm browser extension Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

15 years too late but it's finally here: server-side logic in Power Pages. What does it change in practice? Unlike Azure Functions, it's just another Power Pages asset that can be added to Power Platform ALM. Perfect for anything that is logic-lite/secret-heavy. Think payments and integrations that need secrets. Server-side logic avoids awkward workarounds using plugins, Power Automate, etc. just to keep keys safe. Re-use your Javascript skills though it's not lift-n-shift from the client-side exercise. Just couple new objects to learn: HTTP client for external calls and a Dataverse object for CRUD operations. There are plenty of scenarios where client-side Web API is better, like interaction with external services requiring callbacks, for example. As Nick succulently summed it up: It doesn't make anything possible we couldn't do before. It just makes doing a lot of things we did do before a lot easier. References Power Pages server logic overview (preview) | Microsoft Learn Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

It's one of the biggest Power Pages updates we've seen in years, and we're excited about what it means for the future. We talk about the newest Power Platform release and its biggest change — bringing Power Pages security together with Dataverse roles. We explain how web roles and contact records now work with system users, making Power Pages security act more like Dataverse. We share what we learned from testing the private preview, including how permissions, ownership, and auditing work now, and what the new "C2" users are. We also wonder what this means for performance, licensing, and people building their own portals. References Overview of Power Pages 2025 release wave 2 | Microsoft Learn Unify Power Pages authorization by merging web role with Dataverse security role | Microsoft Learn Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

In this episode, we take a close look at the history of security issues in Power Pages. We start with the early days — when simple misconfigurations like unchecked table permissions and enabled OData feeds led to major data exposures. These weren't bugs, but they showed how easy it was to set things up the wrong way. We talk about how Microsoft responded and what lessons we've learned about secure defaults and clear documentation. We then move on to more serious vulnerabilities introduced by newer features like the Web API. We explain how some of these flaws allowed access to restricted data using filters and sort clauses, and how those issues were eventually patched. These were real product-level bugs, and some were even exploited in the wild. We also share our thoughts on external authentication providers like Google, and the risks that come with delegating authentication — including phishing techniques that can bypass protections. Finally, we reflect on how Power Pages compares to platforms like WordPress, especially when it comes to architecture and the potential for plugin-related vulnerabilities. Despite recent issues, we think the original design of Power Pages deserves credit for holding up well over time. References Power Pages security | Microsoft Learn Tip #1407: How to secure Power Apps portal from making the news - Power Platform & Dynamics CRM Tip Of The Day Engineered Code - Blog - Power Pages: Another "Leak" https://thehackernews.com/2025/01/severe-security-flaws-patched-in.html https://www.bleepingcomputer.com/news/security/microsoft-fixes-power-pages-zero-day-bug-exploited-in-attacks/ https://www.cnn.com/2021/08/24/tech/data-leak-microsoft-upguard/index.html   https://www.upguard.com/breaches/power-apps Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

Continuing from the wishlist, in this episode we focus on underused features in Power Pages - capabilities that are built into the platform but often overlooked during development. We discuss features such as redirects, shortcuts, site markers, and web link sets, highlighting where they fit and why they're still relevant, especially for structured navigation and content management. We also cover content snippets, explaining how they support multilingual content, reduce duplication, and allow non-developers to manage content without modifying code. Additional topics: Leveraging form and list metadata instead of custom JavaScript Choosing fetchXML in liquid over Web API for secure, server-side queries The challenges and potential of conditional multistep forms The role of site settings in fine-tuning authentication and behavior A lot of Power Pages features are often overlooked. Hopefully you get some extra ammunition to improve structure, usability, and long-term maintainability across projects. Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

In this episode, we deliver on their promise from the previous show — a wishlist of features they'd love to see in Power Pages (and none of them are AI). It's a mix of practical frustrations from real-world projects and some wild ideas for future innovation. What did we talk about? George's standing desk automation project — powered by Python, Bluetooth, and (eventually) Power Platform. Imagine your desk going up automatically before every meeting! Top Power Pages wishlist items: API to clear the cache — long-requested, simple sounding, yet still missing. Modern Forms — it's time to modernize the end-user experience beyond Bootstrap upgrades. Support for Quick View and Quick Create forms — why only Main forms? Multi-step form improvements — allow skipping between steps, especially when there are no conditions. Bring back Front-Side Editing — content editing without admin rights is a must for real CMS scenarios. Power Automate integration in forms and lists — run flows like classic workflows directly from UI. Framework agnostic design — let's dream big: support Tailwind, Foundation, or other CSS frameworks beyond Bootstrap.   What's next? How about a tour of Power Pages features that already exist — but almost nobody uses. Credits Cover image by chatGPT (inspired by terrible prompts) References rhyst/linak-controller: A Python script to control Linak standing desks Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

In the first episode of 2025, Nick and George break down Release Wave 1 2025 for Power Pages, separating real improvements from underwhelming updates. AI features take center stage, but do they actually add value? Discussion covers AI-assisted forms, web agents, and natural language queries, questioning their usefulness in real-world applications. Modern lists get long-awaited updates, including JavaScript event support and metadata filters, finally closing gaps with classic lists. The ongoing file upload saga resurfaces, and the new virus scanning feature raises questions about effectiveness. A streamlined Microsoft Entra ID setup wizard promises easier authentication setup, but handling failed logins remains tricky. A surprising security threat in social logins also comes up — cross-IdP impersonation —where external authenticator can let attackers register an account with someone else's corporate email. With event portals moving from outbound marketing to Power Pages, the clock ticks toward a July 2025 deadline for migration. Anyone still using the old Angular-based event sites needs to start planning now. Want to know what's missing from this release? A wishlist of features Power Pages actually needs is coming next time. Don't miss it! Credits Cover image by chatGPT (inspired by terrible prompts) References Overview of Power Pages 2025 release wave 1 | Microsoft Learn Transition events from outbound marketing to real-time journeys - Dynamics 365 Customer Insights | Microsoft Learn Combining Verification Phishing and Cross-IdP Impersonation Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude

In this somewhat warm episode, George and Nicholas explore web templates in Power Pages, breaking down how they work, their history from ADX Studio to modern-day template blocks, the regrets along the way, and practical ways to use them effectively. They discuss features like include and extend, share tips for simplifying your development process, and highlight why templates are a powerful tool for creating reusable components. Whether you're new to web templates or looking to refine your skills, this conversation has something for everyone. As a bonus, they debate what's better as an income stream: Shopify shares or podcasts. Credits Cover image by chatGPT (inspired by terrible prompts) References Web templates | Microsoft Learn Liquid overview | Microsoft Learn Shopify Liquid reference Shopify Stock Quote Get in touch [email protected] Nick Hayduk @Engineered_Code George Doubinski @georgedude