Set Up a Custom Domain for the Self-Service Portal

Applies To: Work 365 Self-Service Portal, Microsoft Power Pages, Power Platform admin center

Overview

This article explains how to replace the default Power Pages site address with a custom domain for the Work 365 Self-Service Portal. Microsoft allows a custom domain only when the Power Pages site is in Production, and only one custom domain name can be added to a website. After the custom domain is configured, Work 365 must be updated so Portal Website URL points to the new address your users will access.

Before You Begin

Before you start, confirm the following:

• The Power Pages site is already in Production. Microsoft states that a custom domain can be added only when the website is in production state.

• You have one of the supported roles for this task. Microsoft lists Website owner, System customizer, System administrator, Dynamics 365 administrator, or Power Platform administrator for adding a custom domain and setting up SSL.

• You can update DNS with your domain provider. Microsoft requires a CNAME that points your custom hostname to the Power Pages site URL.

• For the standard custom-domain flow, you have a password-protected .pfx certificate signed by a trusted certificate authority. Microsoft requires the certificate to include a private key of at least 2048 bits, the full intermediate chain, SHA2, TripleDES encryption for the PFX file, and Server Authentication extended key usage. Power Pages does not support AES-256 encryption for the PFX file.

• If the site uses Content Delivery Network (CDN), understand that HTTPS is handled differently. Microsoft states that CDN-enabled Power Pages sites use Azure Front Door-managed TLS certificates for custom domains, and those certificates are automatically renewed 45 days before expiration.

Resolution

Step 1: Open the Power Platform admin center

Open the Power Platform admin center and locate your site. In the classic experience, go to Resources > Power Pages sites. In the newer admin center experience, Microsoft notes that the tenant-wide site list appears under Security > Power Pages. Select the site, then select Manage.

Step 2: Start the custom domain wizard

On the site details page, select Connect Custom Domain. Microsoft documents this as the standard entry point for adding a custom hostname to a Power Pages site.

Step 3: Choose the SSL certificate

On the Choose a SSL certificate step, do one of the following:

• Upload a new certificate if the certificate has not been uploaded to the organization yet.

• Use an existing certificate if it is already available in the organization.

For standard custom-domain setups, this is where you use the certificate that meets Microsoft’s PFX requirements.

Step 4: Enter the custom hostname

Select Next, then enter the custom domain name, such as portal.contoso.com. Microsoft allows only one custom domain name per website.

Step 5: Validate DNS

Confirm that the required DNS record exists with your domain provider.

For a standard site, Microsoft notes that validation can fail until the CNAME record has propagated across DNS servers. Microsoft also states that an existing TXT record named asuid.{customDomain} can block the domain binding and should be removed before retrying.

For a CDN-enabled site, Microsoft requires a TXT validation record during the custom-domain process. Microsoft states that this TXT record must be created within seven days after enabling CDN; otherwise, you must disable and re-enable CDN before retrying.

Step 6: Review and create the SSL binding

Review the custom hostname and SSL details, then continue to create the SSL binding. When the wizard completes, Power Pages confirms that the custom domain has been configured successfully.

Step 7: Update the Work 365 portal URL

Return to Work 365 and go to Administration > Admin Hub > Portal. Update Portal Website URL with the new portal address and save the record. Work 365’s portal configuration guidance says this field should contain the URL your users will access, and specifically notes that if you are using a custom domain, you should paste that domain here. Work 365’s custom-domain article also notes that the portal can continue to work on the old base URL in addition to the new custom URL.

Troubleshooting

Connect Custom Domain is unavailable

Verify that the Power Pages site is in Production. Microsoft states that custom domains can be added only to production sites.

Domain validation fails

The most common cause is DNS readiness. Microsoft notes that the CNAME may not have propagated yet, which can trigger the message asking you to add a CNAME record and retry later. Microsoft also states that an existing TXT record named asuid.{customDomain} can block the domain binding and should be removed before retrying.

CDN-enabled site validation fails

For CDN-enabled sites, Microsoft requires a TXT validation record during the wizard. Microsoft also states that the TXT record must be created within seven days after enabling CDN; otherwise, you must disable and re-enable CDN before retrying.

Certificate upload fails

Review the PFX file format and certificate properties. Microsoft requires a trusted CA, password-protected PFX, 2048-bit private key or stronger, full intermediate chain, SHA2, TripleDES PFX encryption, and Server Authentication extended key usage. Power Pages does not support AES-256-encrypted PFX files.

You are unsure whether certificate renewal is manual

For standard custom-domain setups, certificate lifecycle management depends on the certificate you upload. Microsoft’s renewal guidance describes replacing the uploaded certificate and updating the binding when the certificate is renewed or reissued. For CDN-enabled sites, Microsoft states that Power Pages uses Azure Front Door-managed TLS certificates that are automatically renewed 45 days before expiration.

Work 365 still points to the old portal address

Update Portal Website URL in Administration > Admin Hub > Portal with the new custom URL and save. Work 365 also notes that after the custom-domain setup is complete, the portal can continue to work on the old base URL in addition to the new custom URL.