Starting on September 14, 2026, Wildcard (*) in the Web API field configuration will have reached end of support.
Microsoft 365 Message Center ID: MC1457694
Last Modified: August 20, 2026
Category: Message Center
Tags: New feature, Admin impact
Status: Launched
Products & Platforms: Power Platform
How does this affect me?
After September 14, 2026, support for the Wildcard value (*) in the Web API field configuration will be removed in phases over the following weeks.
The Wildcard (*) configuration exposes all columns in a Dataverse table through the Power Pages Web API. To improve security and align with least-privilege access principles, Power Pages now requires an explicit list of columns to be specified in the Webapi//fields site setting. This change helps prevent unintended exposure of additional columns and provides greater control over data accessible through the Web API. For more details, please refer to Power Pages portals Web API overview.
What action do I need to take?
If your websites currently use the wildcard value (*) in any Webapi//fields site setting, please perform the below steps:
- Review the tables exposed through the Power Pages Web API.
- Replace the Wildcard value (*) with an explicit comma-separated list of columns that should be accessible.
- Validate your website’s functionality after updating the configuration.
If action is not taken before phased enforcement reaches your site after September 14, 2026, Web API requests against any table that use the Wildcard value (*) may return an HTTP 403 error, which could affect functionality based on those Web API calls until the configuration is updated.
Please contact Microsoft support if you need further assistance.