This is a known Power Pages limitation.
Column‑level Read permissions are not reliably enforced by the Power Pages Web API when using Webapi/<table>/fields = *, especially on Enhanced Data Model sites. Although the docs say “columns not explicitly defined follow All Column Permissions,” the actual behavior matches the documentation example, not the rule text.
Workaround: explicitly list allowed fields in Webapi/<table>/fields instead of *.
This behavior has been reported previously and appears to be a product gap rather than a configuration issue.
1) Is column-level restriction for Read actually supported in Power Pages Web API?
Documented as supported
Not consistently enforced, especially with fields = * and Enhanced Data Model
2) Can All Column Permissions = none + explicit Column: Read be used to hide all other columns?
No, not in practice when using fields = *
Works more reliably if:
You explicitly list allowed columns in Webapi/<table>/fields
You avoid *
3) Is the example row in the documentation incorrect?
Yes, it contradicts the written rules
4)Is there any known issue for this behavior in Enhanced Data Model?
Yes
Reported by multiple users
Especially common when Enhanced Data Model was (or still is treated as) preview‑adjacent for certain security features
✅ If this answer helped resolve your issue, please mark it as Accepted so it can help others with the same problem.
👍 Feel free to Like the post if you found it useful.
