Every authenticated portal visitor is represented internally by a Dataverse Contact record — this is the identity table permissions scope against, and it’s created automatically the first time someone signs in.
Identity providers
Power Pages supports several authentication options: local username/password accounts, Microsoft Entra ID (for internal or B2B scenarios where visitors already have organizational accounts), and external identity providers (Azure AD B2C, or other OpenID Connect providers) for consumer-facing sites. The right choice depends heavily on who’s actually using the site — employees and partners with existing accounts vs. the general public signing up fresh.
Web roles
A web role is the portal’s own, completely separate equivalent of a security role — assigned to authenticated Contacts (and optionally to anonymous/unauthenticated visitors via the “Anonymous Users” role), and referenced by table permissions and page access rules. Common patterns: an “Authenticated Users” role for any signed-in visitor, plus more specific roles like “Premium Customer” or “Partner” for differentiated access.
Anonymous access
Pages and even some table permissions can be configured for unauthenticated visitors — useful for public content like a knowledge base or a product catalog that shouldn’t require sign-in at all. Anything involving a specific person’s own data, by definition, requires authentication first.