Power pages invitation restriction | General question

(0) Share

Report

Posted on by swaminawale

195

Hi everyone,

I'm exploring PowerPages and there I saw we have invitations we can invite contacts to register. Here's my scenario

1. I'll create a new contact

2. Once contact added, a power automate workflow is running that will create a invitation for newly added contact in Invitation table

3. I'm sending simple email to user to invite to my portal and the email looks like below.

Welcome to Portal

Accept invitation here : https://examplexyz.powerappsportals.com/register?invitation=67aeaf09-81ca-47f5-a899-f65804a94123

My concern is, If another user get this invitation code then that user also can login right. Lets say I'm a GOOD user and a BAD user who will get the code from somewhere. and when BAD user put invitation code, it auto populates the email in Email field of the registration form but then he can change the email to another email to login to portal

So Is there a way we can check that InvitationCode with the contact like, XYZ invitation code valid for only ABC user?

Let me know if more clarification required 🙂

Thanks

Categories:

General topics

I have the same question (0)

All responses (2)

Answers (1)

Sort by

Verified answer

Fubar Super User 2026 Season 1 on at

Like
a
(0)

Report
Copy link

Link copied!

The Invitation should be linked to the Contact record before you send it, this is how it knows which Contact the Invite is for (doesn't need to look at email address). Redeeming the invitation will (depending on what Authentication you are using) either update the Contact record if using local authentication or create an External Identity record linked to the Contact record if using an External Identity Provider,

So it is important that you have the initial Email address correct before you send the Invitation, less of a concern if they are a stand alone person with no existing records or personal data, more of a concern if they have existing data or belong to an Account that gives them access to other data also.

As you are sending the Invite you will already have the email address on the Contact record, you could write a dataverse realtime plugin to trigger on change of email address and if the pre Image is different to the current value throw an error (but you will then need to work around legitimate email address changes).

Was this reply helpful? Yes No
Abhishek Bihani 45 on at

Like
a
(0)

Report
Copy link

Link copied!

@swaminawale -
Ideal process is :
1. Create contact with email address & send invitation to register to portal.
2. User will get an email with invitation link so user can redeem from that link
3. As soon as user will be registered security stamp will be populated.

Was this reply helpful? Yes No