Power Pages Encrypted OpenID Connect ID Tokens: What to Know Before the 2026 Rollout

Microsoft is planning to close that compatibility gap. Under AI at Work roadmap ID 576395, titled Power Pages: Design studio - Enhance OpenID Connect with encrypted token support, Microsoft outlines an update that allows Power Pages to accept encrypted OpenID Connect (OIDC) ID tokens alongside traditional signed ID tokens during authentication.

Here is a look at what Microsoft has disclosed about the capability, how it fits into existing Power Pages OpenID Connect workflows, and what administrators should keep in mind before adjusting their identity architectures.

What Roadmap ID 576395 Brings to Power Pages​

According to Microsoft's AI at Work roadmap and the corresponding Power Platform 2026 release wave 1 documentation on Microsoft Learn, this feature introduces token-level encryption support during authentication. Specifically, it enables Power Pages to accept encrypted ID tokens in addition to signed tokens.

Microsoft positions the update around three primary operational goals:

• Encrypted claim transmission: Protecting the contents of ID tokens so that identity claims are not exposed in readable form during authentication.
• Expanded identity provider compatibility: Allowing Power Pages sites to integrate with advanced external identity providers that mandate or issue encrypted ID tokens to satisfy stricter security and compliance requirements.
• Continuity for existing sign-in flows: Strengthening authentication security for sensitive, external-facing applications without altering how end users experience the sign-in flow.

Rollout Status and Timeline Estimates​

Administrators tracking this capability should treat the published dates as planning estimates rather than guaranteed deployment milestones:

While both the AI at Work roadmap entry and the Microsoft Learn release-plan page (last updated August 27, 2026) list August 2026 for public preview, the roadmap still categorizes the feature as "In development" with a projected December 2026 general availability window. Microsoft explicitly notes on both pages that delivery timelines are estimates subject to change and that projected functionality may not be released. Furthermore, Microsoft Learn's release plan notes that starting in September 2026, standalone release plans are no longer being published; instead, new Dynamics 365, Power Platform, and Dataverse capabilities are tracked directly on the AI at Work roadmap.

Section Summary: Roadmap item 576395 plans to add encrypted ID token support to Power Pages OpenID Connect authentication, with general availability estimated for December 2026 across standard multi-tenant web environments.

Why Encrypted ID Tokens Matter in OpenID Connect​

In a standard OpenID Connect flow, an identity provider issues an ID token—a security token that enables the client application to verify the user's identity and obtain basic profile attributes known as claims. Typically, these tokens are cryptographically signed JSON Web Tokens (JWTs). Signing proves who issued the token and guarantees that the payload was not tampered with in transit, but a standard signed token is merely base64url-encoded, meaning anyone who intercepts or inspects the raw token can read the claims inside it.

When a high-trust scenario—such as a government citizen portal, financial services hub, or healthcare partner site—transmits personally identifiable information or sensitive organizational identifiers inside an ID token, compliance frameworks or identity provider policies may require JSON Web Encryption (JWE) at the token level. By supporting encrypted ID tokens in addition to signed ones, Power Pages aims to interoperate with those stricter OpenID Connect configurations.

At the same time, it helps to keep the security scope in perspective. Accepting encrypted tokens protects claim confidentiality between the identity provider and Power Pages and unlocks compatibility with providers that enforce token encryption. However, it does not replace standard token signature verification, issuer validation, or Dataverse authorization controls.

Section Summary: While signed ID tokens verify authenticity and integrity, encrypted ID tokens add confidentiality to the claims inside the token—a requirement enforced by certain regulated identity providers.

How OpenID Connect Currently Works in Power Pages​

Because Microsoft has not yet published separate implementation documentation detailing whether encrypted token support introduces new key-management settings or supported encryption algorithms, administrators should review the baseline OpenID Connect requirements documented on Microsoft Learn:

1. Autodiscovery Metadata Document: Power Pages requires an OpenID Connect metadata document (commonly hosted at /.well-known/openid-configuration) to build authorization requests and validate authentication tokens.
2. Public JWKS URI: The discovery document must specify a jwks_uri endpoint where the identity provider publishes the public keys Power Pages uses to verify ID token signatures.
3. Required Email Claims and Contact Mapping: According to Microsoft Learn's OpenID Connect FAQ, Power Pages requires an email address claim in the ID token named email, emails, or upn (processed in that exact order) to populate the Primary Email Address on the Dataverse contact record. How Power Pages matches a signing-in user to an existing Dataverse contact depends on the AllowContactMappingWithEmail setting: when enabled, it matches by Primary Email Address using those email claims; when disabled, it matches by Username using the unique user identifier claim (sub or oid).
4. UserInfo Endpoint Option: As documented in Microsoft's Power Pages authentication documentation, basic attributes can be passed directly in ID token claims, or administrators can retrieve detailed user attributes from a secure UserInfo API endpoint by creating the site setting Authentication/OpenIdConnect/{ProviderName}/UseUserInfoEndpointforClaims and setting it to true.
5. Client-Side Token Isolation: Microsoft notes that the ID token provided by an OpenID Connect identity provider is used strictly for authentication and is not accessible via JavaScript or standard client-side techniques.
6. Site Configuration Workflow: Makers configure external providers in the Power Pages studio under Security > Identity providers, where they can add or edit an OpenID Connect provider. Changes to authentication settings can take several minutes to propagate unless an administrator restarts the site from the admin center.

Section Summary: Existing Power Pages OpenID Connect integrations rely on a metadata discovery document, a jwks_uri endpoint, and specific identity claims (email, emails, or upn) to map external users to Dataverse contacts.

What Remains Unknown Ahead of General Availability​

While the roadmap states that the feature is "Enabled for end users automatically" and works "without changing existing sign-in flows," there is an important distinction between the end-user login experience and back-end administrator setup.

For encrypted ID tokens to work in practice, the identity provider must encrypt the token using a public key whose corresponding private decryption key is held by the relying party (in this case, Power Pages), or via a shared secret. Currently, neither the roadmap entry nor the release-plan summary specifies:

• Which cryptographic key-encryption and content-encryption algorithms Power Pages will support.
• How certificates or decryption keys will be provisioned, rotated, or configured in the Power Pages Design Studio or site settings.
• Whether any specific identity providers require custom parameters alongside the standard OpenID Connect setup.

Practical Guidance for Administrators​

If your organization has been holding back a Power Pages deployment because an external OpenID Connect provider mandates encrypted ID tokens, roadmap ID 576395 is the item to watch. However, do not alter production identity provider policies to enforce token encryption until Microsoft updates its official "Set up an OpenID Connect provider" documentation on Microsoft Learn with the exact configuration prerequisites and confirms general availability.

In the meantime, teams preparing for external OpenID Connect integrations can validate their provider's /.well-known/openid-configuration discovery endpoint, confirm whether their provider also uses capabilities like private_key_jwt in token_endpoint_auth_methods_supported, and audit how AllowContactMappingWithEmail and email claims are structured in their Dataverse test environments.

Section Summary: Although the roadmap notes automatic enablement for end users, administrators should wait for Microsoft Learn documentation on key management and supported encryption algorithms before enabling encrypted ID tokens in production.