Summary
- Power Pages is retiring support for wildcard (*) in Web API field configuration for Dataverse tables.
- Websites that currently use the wildcard in any Webapi/<table-name>/fields site setting are affected.
- Administrators should replace wildcard entries with an explicit comma-separated list of allowed columns.
- After enforcement, affected Web API calls may fail with HTTP 403 if configuration is not updated.
Microsoft 365 Message Center ID: MC1457694
Primary Service: Power Platform
Admin Impact: High
User Impact: Low
Release Start: 14 Sept 2026
Release End: 14 Sept 2026
Last Modified: August 20, 2026
Category: Stay informed
Tags: New feature, Admin impact, Admin action
Status: Launched
Products & Platforms: Power Platform, Dataverse
Starting on September 14, 2026, Wildcard (*) in the Web API field configuration will have reached end of support.
How does this affect me?
After September 14, 2026, support for the Wildcard value (*) in the Web API field configuration will be removed in phases over the following weeks.
The Wildcard (*) configuration exposes all columns in a Dataverse table through the Power Pages Web API. To improve security and align with least-privilege access principles, Power Pages now requires an explicit list of columns to be specified in the Webapi//fields site setting. This change helps prevent unintended exposure of additional columns and provides greater control over data accessible through the Web API. For more details, please refer to Power Pages portals Web API overview.
What action do I need to take?
If your websites currently use the wildcard value (*) in any Webapi//fields site setting, please perform the below steps:
- Review the tables exposed through the Power Pages Web API.
- Replace the Wildcard value (*) with an explicit comma-separated list of columns that should be accessible.
- Validate your website’s functionality after updating the configuration.
If action is not taken before phased enforcement reaches your site after September 14, 2026, Web API requests against any table that use the Wildcard value (*) may return an HTTP 403 error, which could affect functionality based on those Web API calls until the configuration is updated.
Please contact Microsoft support if you need further assistance.