Power Pages is becoming a more complete enterprise web platform

Building a Power Pages site has never been the hard part. Running it well for the next three years is. The September 2026 updates are interesting because so many of them are about operating a site: security posture, analytics, logging and site management.

What the September update brings

Microsoft's September 2026 Power Platform update highlights, for Power Pages:

• a Security agent in preview, in the Security workspace;
• site analytics and server logging in preview;
• improvements to authentication and agent configuration, plus new guidance on securing sites.

Some foundations are already further along: secure server-side logic has been generally available since April 2026, and Power Platform CLI support for creating and deleting websites since August.

The Security agent as a review partner

Microsoft describes the Security agent as an AI assistant that reviews a site's security posture, examines authentication and authorisation configuration, flags potentially broad access and helps configure settings. Importantly, it asks for approval before changing anything.

That approval step deserves respect. A suggestion to create a web role or change table permissions is not a formatting tweak. It changes who can see or modify Dataverse data.

A simple operating rhythm

With better analytics, logging and CLI tooling, a site can have a proper operating routine. Mine looks like this:

• Monthly — review anonymous access, web roles and table permissions against the agreed baseline.
• After every release — check server logs for new errors and the analytics for journeys that suddenly drop off.
• Quarterly — re-run the security review and retire pages, roles and permissions nobody uses any more.

None of this is exciting. All of it is what keeps an external site trustworthy.

Know what is still preview

The Security agent, security scanning, traffic monitoring and parts of analytics are previews and may change before general availability. Build the routine around what you can rely on today, and add the preview pieces as they mature.

The best Power Pages improvement is not faster site creation. It is bringing security and operations closer to where the site is built. I would rather run a smaller site with a clear permission model than a polished portal nobody can confidently change six months later.

A practical next step

Write a one-page baseline for one live site: public pages, sign-in personas, Dataverse tables, web roles, table permissions, authentication providers and known gaps. Every future change — including the Security agent's suggestions — gets reviewed against that page.