Power Pages – Collecting attachments from anonymous users

In my previous article, I went through how MS Forms can be used to collect attachments from anonymous users. However, there is one problem with the proposed solution. File sharing on the SharePoint site should be allowed for everyone. In practice, for anonymous users outside the organization.

This option is often limited in organizations at an environmental level, in which case it is impossible to allow it for any individual site.

Fortunately, we have other options. This time, with Power Pages, we will implement a simple solution that drives the same requirements.

• A form that anyone can use to report an incident
• An incident can have 0-n attachments

Let’s get started.

Creating a new Power Pages site

Let’s go to make.powerpages.microsoft.com and select the appropriate environment. Here I use my development environment (Timo’s Dev Environment).

Experienced Power Pages developers start from scratch, but this time I use ready-made templates.

There are several ready-made templates. Let’s choose the best-looking one from the Starter layout options.

Let’s give the site a name and address.

Creating a website takes a while.

The starting point looks like this.

With Power Pages, you can easily create pages that present static content. However, the real beauty lies in its ability to leverage the Dataverse. We can show the content of Dataverse tables to users. We may also allow users to add new rows to the Dataverse and even update existing rows.

And that’s exactly what we’re doing now. We want to offer users a way to add rows to the Dataverse incident table.

Creating a new table

The incident table doesn’t exist yet, so let’s create it. Go to the Data section (1) and select Create a new table (2).

Let’s give the board a name. We are adding attachments related to incidents, so let’s check the Enable attachments tickbox.

Add a description field for the incident.

Creating a new form

Next, we’ll create a form to add incidents on the Power Pages page. This is done with the New form (2) feature found in the Forms section (1) of the table.

Let’s give the form a name.

Remove the timeline from the form and add a description field. Finally, as usual, Save and publish.

If Dataverse and model-driven applications are already familiar, there is nothing new here.

Adding a form to a page

We will add an incident form to the website’s home page.

The form can be created in a modern way using copilot, but let’s go the traditional way and select “New form”.

We select the table where the information entered in the form is saved (Incidents) and the new form we just made (New Incident). Finally, name the copy of selected form.

Enable the attachments. The other settings of the form are fine for us as they are.

And so we have a form on the page where you can add new incidents.

Permissions

Site users do not yet have the right to add an incident. The necessary rights can be defined from the New permissions button.

But what permissions does the user need?

Access type options are as follows:

• Global access (all items)
• Contact access (items related to the contact record corresponding to the user)
• Account access (items related to the account record related to the user)
• Self access (the user can edit the information of the corresponding contact record)

We are making a site for anonymous users, so the first option remains (global access).

Adding a new item (Create) is sufficient for our purpose. To add attachments, you also need append to permission.

Finally, an anonymous user is added as a role.

Note that now users do not have permission to read incidents. Users cannot read the records they created, but neither can they read the records created by anyone else. Although they have Global access type rights to the table.

Cleaning the site

Along with the template we used, everything useless has come to the site. The front page has sample contents and the site contains several pages.

Let’s delete all pages except the front page.

As well as useless content on the front page.

After cleaning, the page looks like this.

Edit site header

The site should be further stripped. Search and login in the upper right corner should be removed. Our site only has one page, and no one is supposed to log in anywhere.

Select “Edit site header” from the top bar.

From the dialog that opens, you can edit, among other things, the logo and title text. But not the links on the right side. However, we can open the code with Visual Studio Code with the Edit code button at the bottom.

The header code (header.html) opens in the browser for editing.

And now be careful. If you don’t know what you’re doing, you can mess up the site code by editing it. And even if you know, at this point you should start saving source codes with changes in version control.

The changes are saved, after which they are synchronized.

The login link disappears.

Deleting a search

The site search can be disabled in the settings (Set up -> Copilot -> Site search -> Enable keyword search).

As long as you remember to synchronize the changes, the title bar will look like this.

Good enough for this example.

Site colors and logo

Let’s update the header bar texts, colors and logo to our liking.

The rest of the color and font specifications are made in the Styling section.

Login settings

We have hidden the login link, but just to be sure, we will remove all authentication options (Security -> Identity providers). Our website is used only by non-identified users.

Please note that the CAPTCHA feature can be used directly with Power Pages forms. It makes sense to use it, however, it is a public site.

Costs

What does it cost to run such a site?

€70.20 per month. Including 500 users per month.

Summary

Power Pages is an excellent way to build services for users outside the organization (authenticated or anonymous). As long as

• User numbers are moderate
• The service has some connection to the Power Platform

The solution to this case is a good example of this. Users report a maximum of a few hundred incidents with attachments every month through the site. The data is stored directly in Dataverse, where it can be processed with other Power Platform tools within the organization.

Identified users can be shown information related to them and even allowed to be edited by users. For example, account-related devices, etc. Very convenient and straightforward to implement.

But would I implement the city’s public website with Power Pages? No, I wouldn’t.