Some of the most valuable Power Platform solutions are the ones that reach outside the organization. This use case is a good example: a secure Power Pages portal that lets contractors, suppliers, and plant visitors submit safety incident documentation, while the heavy lifting of routing, redaction, storage, and approval happens automatically behind the scenes. It is a practical, end-to-end pattern that touches Power Pages, Dataverse, Power Automate, SharePoint, Microsoft Entra ID, and Azure AI Services.
The scenario
A contractor, supplier, or plant visitor needs to submit safety incident documentation through a secure portal. The submission is not always a simple form. It often includes supporting evidence and personal details that should never reach a reviewer unredacted. Typical submissions include:
- Near-miss reports
- Injury reports
- Equipment damage reports
- Site inspection photos
- Corrective action evidence
- Safety training completion proof
Business value
The portal does more than collect a form. It gives the Environment, Health, and Safety team a single, governed intake process with a full audit trail. In practice, it lets the organization:
- Collect incident details from external users who have no internal account
- Accept supporting evidence as file uploads
- Capture file name and document type as structured metadata
- Redact sensitive personal information before review
- Route submissions to the EHS and Safety team automatically
- Maintain a complete audit history
- Track corrective actions through to closure
Solution architecture
The design is a clean left-to-right pipeline. An external user submits through Power Pages, the record lands in Dataverse, and Power Automate orchestrates everything that follows. Microsoft Entra ID secures access at the front door, and the downstream services handle redaction, storage, and notifications.
Each product has a clear job in the stack:
- Power Pages hosts the external submission portal with the form and file upload.
- Dataverse stores the incident record and all of the file metadata.
- Power Automate handles routing, the redaction check, notifications, and approval.
- SharePoint stores the uploaded documents, keeping the original and the redacted copy.
- Microsoft Entra ID secures access to the portal and the data behind it.
- Azure AI Services provides the optional redaction of sensitive details.
- Outlook and Teams deliver notifications to reviewers and submitters.
The user journey
From the submitter’s point of view, the experience is short and simple. The complexity is deliberately hidden behind the form.
- The user opens the Safety Incident Portal.
- The user selects the incident type.
- The user enters location, date, description, and contact details.
- The user uploads a supporting file.
- Power Pages creates a Dataverse record.
- Power Automate routes the record to the Safety and EHS team.
- If sensitive information exists, the document is redacted.
- A reviewer approves, rejects, or requests more information.
The Dataverse table
Everything about a submission lives in a single Dataverse table, Safety Incident Submission. Keeping the incident details, the file metadata, and the review state together is what makes the audit history reliable and the corrective-action tracking possible.
The fields fall into four natural groups. Incident details hold the Incident Title, Incident Type, Location, Incident Date, and Description. The submitter is captured through Submitted By and Contact Email. The file and redaction group covers the File Upload, the Original File Name, the Redacted File Name, and a Redaction Required flag. The review group tracks the Status, the Reviewer, and any Review Comments.
File upload examples
Capturing the original file name as metadata makes the records searchable and the audit trail meaningful. Typical uploads look like this:
Forklift_Damage_Photo.pngNear_Miss_Report.pdfCorrective_Action_Evidence.docxSafety_Training_Completion.pdf
How redaction works
This is the part that turns a basic intake form into a governed process. When a submission contains personal information, Power Automate calls Azure AI Services to produce a redacted copy. Reviewers work from the redacted version, while the original is preserved separately for audit.
A simple before-and-after makes the point. The original file might contain:
Employee Name: John SmithPhone: 555-123-4567Medical Notes: Minor hand injury
After redaction, the reviewer sees only:
Employee Name: [REDACTED]Phone: [REDACTED]Medical Notes: [REDACTED]
Status flow
Every submission moves through a predictable set of states, which is what makes corrective actions trackable and the queue easy to manage. A submission is Submitted, then enters Pending EHS Review. If personal data is present it passes through Redaction Required, then becomes Ready for Approval. From there it is Approved or Rejected, and finally Closed.
A simple demo story
A contractor submits a near-miss report through Power Pages. They enter the incident details, upload photos, and submit the form. Dataverse stores the incident record and file metadata. Power Automate notifies the EHS team, checks whether redaction is required, stores the redacted version separately, and routes the submission for approval. The original file is preserved for audit, while reviewers work from the redacted copy.
Why this pattern works
What makes this a strong reference design is the separation of concerns. Power Pages keeps the external surface simple and secure. Dataverse gives every submission a structured home and a real audit history. Power Automate removes the manual steps that usually slow down an EHS intake process, and the redaction step protects personal information without losing the original for compliance. It is the kind of solution that delivers immediate value to a safety team while staying fully governed, and it scales from a single site to an entire organization without changing the core design.
This use case is a reference pattern. Adapt the redaction approach, storage location, and approval routing to your own compliance requirements and licensing before building it in production.