PathixDataverse Forensics
Capability · Power Pages exposure

What can a visitor who never signs in reach?

A Power Pages site (the product formerly named Power Apps portals) decides that across table permissions, web roles and site settings, in surfaces that do not talk to each other and mostly cannot be reviewed on one screen. Pathix reads them as one model, then follows the chain from a page through its form to the columns underneath, so the question stops being which pages are open and becomes which columns an open page touches.

Book a walkthrough →Or jump to the 14 Power Pages findings →
The site, inventoried

Everything the site is assembled from, counted once.

Pages, templates, snippets, forms and lists, alongside the web roles and access rules that gate them. The figures below come from a scan of the Microsoft out-of-the-box scheduling template, which is why they can be published at all.

Pages
34
Web templates
51
Snippets
105
Basic forms
15
Lists
6
Web roles
6
Access rules
10
Anonymous-reachable
26
at the access-rule tier

That last figure is the one worth being precise about, so the rest of this page is largely about what it does and does not mean.

What the number means

An anonymous visitor's reach is six layers. Pathix reads five.

Reach is not one setting, it is a stack, and a scan can read all of it but the top. So Pathix reports what the configuration grants and says plainly which layer it could not see. A site nobody can reach makes every finding on this page moot, and Pathix will not pretend otherwise to make the number look worse.

LAYER
READ BY SCAN
WHAT IT DECIDES
Table permission
YES
The grant itself: right, scope and the table it names.
Web role binding
YES
Which roles the permission is attached to, read from the form rather than the advertised relationship.
Anonymous role marking
YES
Which web role the site treats as its anonymous users role.
Site settings
YES
Web API enablement and the per-table column list, open registration, local login.
Column security
YES
Column-secured columns and whether the configured list reaches them.
Site visibility
NO
Whether the site is published and reachable from the public internet. Not readable by an unattended scan, permanently. A private site neutralizes everything above it.

Every Power Pages finding Pathix raises inherits that bound. The wording on each one is a statement about configuration, never a verdict that data is public, and that is a deliberate limit rather than a hedge: see the findings themselves.

In the product

This is the screen. The rest of the page takes it apart.

One page of the console, scanned from the Microsoft out-of-the-box scheduling template, unedited: the counts along the top, the badge on every page in the tree, the assembly of the selected page, the walk through its form steps, and the rule that decides who gets in. The sections that follow are this screen redrawn a piece at a time, because at page width the pieces are readable and the whole is not.

The sample scheduling site in the console. Click to enlarge.
The site, as Pathix reads it
The Pathix Power Pages view of a scheduling site. A header strip counts 34 pages, 51 web templates, 105 snippets, 15 basic forms, 6 lists, 6 web roles, 10 access rules, and 26 anonymous-reachable at the access-rule tier. The site tree on the left carries an ANON or AUTH badge on every page, with every admin page authenticated and Home, Search and getAllAppointments anonymous. The right pane shows how the selected page is assembled: the portal web page reaches its page template on one side, and on the other an embed tag leads to the advanced form, which fans out through portal bindings to seven forms, from Appointment Confirmation through Create an Appointment Step 6. Below that, the step graph walks Services, Location, Availability, Scheduling and Details, each loading a model-driven form, and the effective access resolves down the page tree to a single rule granting RestrictRead over AllContent to four web roles.
Access on every node

The page tree, with who gets in written on it.

Access rules inherit down the tree, so the page you are looking at is rarely the page that granted anything. Pathix resolves the inheritance and puts the answer on every node at once, which turns a per-page investigation into a page you can read.

HomeANONAccess DeniedANONBook an Appointment formwizardAUTHgetAllAppointmentsANONProfileANON[Admin] HomeAUTH[Admin] SpecialtiesformAUTH
The walk

Multi-step forms, as the path somebody actually takes.

An advanced form is a sequence, and each step loads a model-driven form of its own. Pathix keeps the whole walk on one graph, including branches, so a step that quietly reads more than the step before it is visible next to the ones that do not.

1. ServicesLOADFORMloadsAppointment Step 1FORM (MODEL-DRIVEN)next2. LocationLOADFORMloadsAppointment Step 2FORM (MODEL-DRIVEN)next3. AvailabilityLOADFORMloadsAppointment Step 3FORM (MODEL-DRIVEN)next4. SchedulingLOADFORMloadsAppointment Step 4FORM (MODEL-DRIVEN)
From a page to a column

The chain does not stop at the form. It stops at the data.

A page embeds an advanced form, the form binds its steps, and the steps read and write a real table. Pathix walks that chain end to end and terminates it on the columns, ranked by salience, so you are looking at column names rather than at a page count.

WEB PAGEBook an AppointmentembedsADVANCED FORMC2 Book an appointmentbinds ×7FORM STEPS · 7Appointment Step 5reads / writesTABLE msdyn_appointmentrequestmsdyn_nameSAL 40owneridSAL 40msdynce_emailaddressSAL 33msdynce_firstnameSAL 32msdynce_lastnameSAL 32msdynce_phoneSAL 18msdynce_phonetypeSAL 18
DETERMINISTIC · EVERY EDGE HERE IS READ FROM CONFIGURATION, NONE IS AI-DERIVED
The same chain in the product, unedited. Click to enlarge.
From the page down to the columns
A Pathix dependency graph resolved left to right. A portal web page, Book an Appointment form, connects by an embed tag to a portal advanced form, C2 Book an appointment, which binds seven forms. One of them, Create an Appointment Step 5, is selected, and seven read-write edges fan out from it to columns of the msdyn_appointmentrequest table: msdyn_name and ownerid at salience 40, msdynce_emailaddress at 33, msdynce_firstname and msdynce_lastname at 32, and msdynce_phone and msdynce_phonetype at 18.

Which is where the earlier caveat earns its keep. This resolves what the configuration connects to what. It is the strongest form of the question you can answer without issuing a request, and Pathix does not issue one.

Which rule did it

Not just the verdict. The rule that produced it.

Every rule that applies to a page is listed with its right, its scope and the web roles it names. An answer you cannot trace back to a rule is an answer you cannot act on, and it is the reason "authenticated" is worth reading twice on a site where four roles satisfy it.

HomeBook an Appointment formrules inherit down the treeRULERIGHTSCOPEWEB ROLES[MBR] Authenticated AccessRestrictReadAllContentAdministrators, Authenticated Users,Web API User for Appointment,Web API User for ContactsAdmits any authenticated visitor, which on this site includes four roles.
What it raises

14 Power Pages conditions, checked on every scan.

These run without being asked for, alongside the rest of the catalog. Each links to what it detects, how to check it by hand, and the bound on what it claims.

Six of them also produce evidence for CMMC AC.L1-3.1.22, the practice about what a publicly accessible system is allowed to hold.

Find out what your site is configured to hand over.

A walkthrough runs the real console on sample data, so you can walk a site tree and follow a page down to its columns before anyone touches your environment.

Book a walkthrough →Read the sample report
© 2026 Pathix L.L.C. · self-hosted · metadata-only
Not affiliated with Microsoft. Dynamics 365, Dataverse, and Power Platform are trademarks of Microsoft Corporation.π