Configuring CSP for Dynamics 365 Event Registration Forms with hCaptcha on Power Pages

When embedding Dynamics 365 event registration forms that use hCaptcha on Power Pages, you need to configure the Content Security Policy (CSP) correctly to ensure the form loads and functions as expected.

Required CSP Directives

Add the following CSP directives to allow the form and hCaptcha to load without violations:

connect-src

'self' https://content.powerapps.com https://*.microsoft.com https://cxppusa1formui01cdnsa01-endpoint.azureedge.net https://public-apj.mkt.dynamics.com

default-src

'self' https://cxppusa1formui01cdnsa01-endpoint.azureedge.net https://public-apj.mkt.dynamics.com https://*.hcaptcha.com

font-src

'self' https://fonts.googleapis.com https://fonts.gstatic.com https://*.sharepointonline.com http://*.cdn.office.net https://*.microsoft.com https://content.powerapps.com

form-action

'self'

frame-ancestors

'self' https://*.hcaptcha.com

frame-src

'self' https://*.hcaptcha.com

img-src

'self' data: https://content.powerapps.com https://*.microsoft.com https://*.azureedge.net https://public-apj.mkt.dynamics.com

object-src

https://cxppusa1formui01cdnsa01-endpoint.azureedge.net

script-src

'self' 'unsafe-inline' 'unsafe-eval' https://*.microsoft.com https://content.powerapps.com https://cxppusa1formui01cdnsa01-endpoint.azureedge.net https://public-apj.mkt.dynamics.com https://www.gstatic.com https://www.google.com https://*.hcaptcha.com

style-src

'self' 'unsafe-inline' https://fonts.googleapis.com https://*.microsoft.com https://content.powerapps.com

---

Tip

Always verify these settings in your Power Pages site configuration and test the form to ensure hCaptcha renders properly without CSP violations.