Block unauthenticated calls to /_odata/$metadata

(0) Share

Report

Posted on by silgenfritz

I am looking for a way to block unauthenticated portal users from making calls to the /_odata/$metadata endpoint. We use OData calls for Authenticated users and because this is enabled in the portal metadata calls can still be made against the metadata by users not logged in.

Categories:

Security

I have the same question (0)

All responses (2)

Answers (0)

Suggested answer

SaiRT14 1,990 Super User 2025 Season 1 on at

Like (0)

Report
Copy link

Link copied!
pls try the following:

Go to Power Pages / Power Apps Portals Management in your environment.

Under Table Permissions, configure permissions for tables accessible through OData by setting them to allow only specific security roles (e.g., Authenticated Users).

Ensure no permissions are granted to Anonymous Users or any roles associated with unauthenticated access.

Was this reply helpful? Yes No
Suggested answer

rulesrchanged1 Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

You cannot block this endpoint to be used by only authenticated users. Although this will not mean that anonymous users can see any data of the table.

Also old odata lists are actually deprecated and would be removed in future, so i will suggest rather moving to webapi which provides better functionality as well as control.

Was this reply helpful? Yes No