Web apps often need to share public information or collect simple submissions such as letting visitors browse a product catalog or register for an event without creating the friction of mandatory sign-in. Anonymous data access solves this by allowing an app to expose only specific data and operations for public use, while keeping sensitive data and privileged actions protected behind authentication. Organizations remain in control through tenant admin settings that determine who can build public-facing apps.
Public access, with layered control
A single app can make selected entities publicly readable or writable while requiring users to sign in for everything else.
Access is governed through three independent controls:
- Tenant setting: A Fabric tenant administrator enables anonymous data access for the organization or selected security groups. Figure: Enable anonymous data access for Fabric Apps in tenant admin settings.
- Data-model role: Each entity defines the operations available to the anonymous role, such as read or create.
This layered design gives administrators an organization-wide boundary, gives app owners an explicit opt-in, and keeps the final authorization decision close to the data model.
Designed for focused public experiences
Developers can use anonymous data access to create experiences that are useful without requiring every visitor to have an account.
- Public reference data, such as product catalogs, schedules, announcements, or public datasets, is best exposed with read access only.
- For community event registration, apps can use create access so visitors can submit a registration without being able to view or modify other entries.
Define anonymous access in a data model
Use the @role decorator on an entity and specify anonymous as the role name. The second argument defines the allowed data operations: create, read, update, or delete.
The following example allows unauthenticated users to submit a community event registration:
import { entity, role, uuid, text } from '@microsoft/rayfin-core';
@entity()
@role('anonymous', 'create')
export class CommunityEventRegistration {
@uuid() id!: string;
@text() eventId!: string;
@text() attendeeName!: string;
@text() attendeeEmail!: string;
}
The anonymous role doesn't use identity claims because no signed-in identity is available. Define the narrowest set of operations that supports your scenario.
Best practices
Anyone who can reach the app URL can use the operations assigned to the anonymous role. Developers should never expose personal, confidential, financial, or internal business data through this role.
Recommended practices:
- Grant the minimum operation required such as to read or create.
- Limit exposed fields so public callers receive only what they need.
- Enforce permissions in the data model, not only in the app interface.
- Validate untrusted input and plan for spam, automation, and unexpected traffic.
- Monitor usage and test that every operation omitted from the anonymous role is rejected.
Get started
Anonymous data access unlocks a new class of carefully scoped public experiences in Fabric Apps—from open reference data to simple submission workflows—without forcing developers to choose between reach and control.
Learn how to enable and use the capability in the anonymous data access documentation.
Microsoft Employee