Using Dataverse low-code plugins for server side data validation in Power Pages

When we use Power Pages Web API, we can explicitly enable which fields we allow to be used in a Power Pages site, and also what fields can be changed or not via Web API (using Column Permissions). However, there is no configuration to prevent certain values from being added/used in Power Pages Web API calls.

We can use Dataverse plugins to validate the data before an update is committed. This can be done via either traditional C# plugins, as in my previous post, but also in the new Dataverse low-code plugins (currently in Preview). Even though instant low-code plugins are deprecated, the automated low-code plugins are not. If they go GA, it could be an interesting option for adding data validation on the server side for Power Pages Web API updates.

This post brings a basic sample of how to prevent certain Choice values from being used on Web API calls.

Dataverse accelerator app

To create low-code plugins, you will need to use the Dataverse accelerator app. In this example, let’s create a plugin that validates Create operations (the same can be used for updates but you need a separate plugin created).

Select the option to create an automated plugin:

Plugin details

Select the table you want to create, and usse the following Power Fx logic (or adjust as required) as the expression:

If(StartsWith(NewRecord.'Modified By'.'Full Name',"# Portals"), 
   If(NewRecord.'Support Ticket Status' <> 'Support Ticket Status'.Draft && NewRecord.'Support Ticket Status'<> 'Support Ticket Status'.Submitted,
   Error("You can only create records with Draft or Submitted Status")
   )
)

In my case, the table is named ‘Support Tickets’ and I want to validate a choice field ‘Support Ticket Status’, so that the Power Pages user cannot create records with a status that is not equal to ‘Submitted‘ or ‘Draft‘. If the status is different than what I want, I can then show an error message, using the ‘Error’ function.

In order to detect that this call was made via Power Pages, since we have no equivalent property to what we have on C# plugins for IsPortalsClientCall, I am checking if the user that modified the record has the name starting with “# Portals” as all Power Pages application users by default have that as a name convention.

Under the advanced options, select ‘Pre-operation’ as the stage the plugin should run.

Select also the solution you want the plugin to be added.

Testing

On a page where we have the Web API wrapper code added, you can use the developer tools to play around.

If you send a request with an invalid choice option, as below:

You get an error thrown by the Plug-in:

This error will be thrown only via calls made by Power Pages, if you try to create an item via a Model Driven apps it will allow any status value.

Conclusion

Low-code plugins can help us to improve validation in Power Pages and quickly implement server-side scenarios that previously would be possible only using Visual Studio and C# code. Currently, Low-code plugins are in preview; be mindful and don’t use them for production scenarios yet.

Note: When the feature Unify Power Pages authorization by merging web role with Dataverse security role is released, this approach might need to change.

References:

Use Low-code plugins in Dataverse – Microsoft Learn

The post Using Dataverse low-code plugins for server side data validation in Power Pages appeared first on michelcarlo.

Original Post https://michelcarlo.com/2025/07/21/using-dataverse-low-code-plugins-to-validate-data-added-via-power-pages/