Password Protect a Page in AI Builder Manual Mode

Updated 6 November 2026 · Standard formula, shown below

To password protect a page in AI Builder manual mode, you add a password field to your form and configure the page’s visibility rules to require that password before the page is shown. This guide walks through the exact steps, explains how the protection works, and covers common pitfalls.

What AI Builder Manual Mode Is

AI Builder is a Microsoft Power Platform feature that lets you add AI models to your apps and workflows. In the context of form processing, “manual mode” refers to the configuration of a form processing model where you manually define the fields and layout rather than letting the AI auto-detect them. This mode is useful when you have a known form structure and want precise control over which data is extracted.

Password protecting a page in manual mode is not a built-in one-click feature; it requires you to combine form fields, conditional visibility, and possibly a custom connector or Power Automate flow. The approach below uses standard Power Apps canvas app capabilities, which is the most common environment for AI Builder forms.

Step-by-Step: Add Password Protection

Open your canvas app in Power Apps Studio. If you haven’t already, add the AI Builder form processing component to your app and configure it in manual mode.
Add a text input control for the password. Name it PasswordInput. Set its Mode to Password so characters are masked.
Add a button (e.g., SubmitPassword) that the user clicks after entering the password.
Create a variable to track whether access is granted. On the button’s OnSelect property, set a variable like Set(IsAuthenticated, PasswordInput.Text = "YourPassword"). Replace YourPassword with your actual password.
Control visibility of the page or the form. Select the page (or the container that holds the form) and set its Visible property to IsAuthenticated. Also set the password input and button’s Visible to !IsAuthenticated so they hide after successful entry.
Test the flow: run the app, enter the correct password, and verify the form appears; enter a wrong one and confirm it stays hidden.

This method protects the page within the app itself. However, it does not prevent a determined user from inspecting the app’s code or variables. For stronger security, consider server-side validation (see below).

How the Protection Works

In Power Apps, the Visible property controls whether a control is rendered. By setting it to a boolean variable, you effectively hide the page until the condition is met. The password check is done client-side, meaning the password is embedded in the app’s code and can be extracted by someone with access to the app file or by using browser developer tools. For a simple gate, this is often sufficient, but it is not secure against determined attackers.

Choosing a Strong Password

If you use a static password in your app, choose one that is not easy to guess. Avoid common words, names, or sequences. Use a mix of uppercase, lowercase, numbers, and symbols. For example, Tr0ub4dor&3 is stronger than password123. Since the password is stored in plain text in the app, anyone with access to the app’s source can see it, so do not reuse a password you use elsewhere.

Common Problems and Fixes

Password not working: Ensure the password comparison is exact, including case sensitivity. In Power Apps, text comparisons are case-sensitive by default. Use Lower(PasswordInput.Text) = Lower("YourPassword") if you want case-insensitive.
Page still visible after entering wrong password: Check that the Visible property of the page is set to IsAuthenticated, not to the button’s text or something else. Also ensure the variable is set correctly in the button’s OnSelect.
Users can see the password in the app’s code: This is inherent to client-side protection. For better security, use a Power Automate flow that validates the password against a data source (like a SharePoint list or Azure AD) and returns a result. Then set the variable based on that flow’s response.
Password input hidden after success: That is intended. If you want to allow re-entry, add a “Log out” button that sets IsAuthenticated to false.

Alternatives to Manual Password Protection

If you need more robust protection, consider these alternatives:

SharePoint list permission: Store the form data in a SharePoint list and restrict access to that list. The page itself can be visible to all, but the data is protected.
Power Apps security roles: In a model-driven app, you can use security roles to control who can see certain forms or fields. This is more integrated but requires a different app type.
Azure AD authentication: Use the app’s built-in authentication to restrict access to specific users or groups. This is the most secure method, as it leverages your organization’s identity provider.

Safety and Security Considerations

Never store sensitive passwords in client-side code if the data is highly confidential. Client-side protection is a deterrent, not a security boundary. For compliance with regulations like GDPR or HIPAA, you must implement server-side controls. Also, be aware that Power Apps canvas apps can be exported and inspected, so any hard-coded secret is exposed.

Frequently Asked Questions

Can I password protect a page in AI Builder without coding?

Yes, you can do it without writing code by using the Visible property and a variable, as shown above. It involves no custom code, only configuring properties and a button’s OnSelect formula.

Is the password stored securely?

No, it is stored in plain text within the app definition. Anyone with access to the app can see it. For better security, use a flow that checks the password against a secure source.

What if I forget the password?

Since the password is in the app’s code, you can open the app in Power Apps Studio and view the button’s OnSelect formula to see the password. If you set it dynamically via a flow, you may need to reset it in the data source.

Can I protect only a part of the page?

Yes, you can set the Visible property of any control or container, not just the whole page. For example, you could hide only the form and show a message.

Does this work in model-driven apps?

No, this method is for canvas apps. In model-driven apps, you would use security roles or business unit security to control access.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.