Power Pages security,by architecture.
22 security and compliance controls, checked against Microsoft Learn for the standard data model, the enhanced data model and single-page application sites. Every control gets one of three states, and every state links to its source.
Three states, no guessing
Most comparisons mix up "not supported" and "nobody wrote it down". In a security review, that difference matters.
A Microsoft Learn page states it for this architecture, or the feature page applies to all sites and the SPA documentation lists it.
Microsoft Learn explicitly excludes it for this architecture.
Microsoft Learn says neither yes nor no. Test it in your tenant before you promise it to a security reviewer.
Environment and tenant controls such as Customer Lockbox or Purview logging don't act on the site, so the site architecture doesn't decide whether you get them. They are listed separately, with their prerequisites.
Pick your architecture
Select the model your site runs on and see what you get, what you don't, and where the documentation goes quiet.
Full comparison
All 22 controls side by side, with prerequisites and the Microsoft Learn page each verdict rests on.
| Control | SDM | EDM | SPA | Prerequisites and caveats | Source |
|---|
Want to know where your portal actually stands?
This reference tells you which controls exist. Whether yours are configured right is a different question.
How this was checked
- Every verdict comes from a Microsoft Learn page, linked in the matrix. Release plans, blog posts and forum answers don't count.
- Standard and enhanced data model: Microsoft states functional parity with no gaps in design studio. Differences listed here are about how you configure a control, not whether you have it.
- SPA sites: based on Create and deploy a single-page application and Microsoft's Power Pages plugin documentation.
- Preview features are marked. Microsoft doesn't recommend them for production.
Spotted a change in Microsoft Learn? Write to [email protected] and I'll update the reference.