Canvas app guest access public preview feedback

[alaugMSFT]

The ability to share canvas apps with guests of an organization will be made available in public preview shortly. Please use this thread to share feedback and questions. This thread will be linked to by the blog announcement coming soon. 

[Sachinbansal]

Hi

Do we know when this feature would be available in Government US Cloud?

Regards

Sachin Bansal

[alaugMSFT]

Hello, @kennisdj051 .

1. A external users will always require a license. However, very soon we'll be enabling a feature that recognizes the license in a user's home and guest tenant so a license doesn't need to be assigned in the guest tenant. 

2. Billing occurs on the number of licenses purchased and not who they're assigned to. There are multiple scenarios where who a license is assigned to may change, which is why https://admin.microsoft.com and https://portal.azure.com can be used to change license assignment. 

3. Yes, licenses are purchased for an organization and then assigned to users within an organization. Billing occurs for licenses purchased for the organization. Since your application is only a one time use, I'm wondering if PowerApps Portal might be a better solution to your scenario. Feel free to send me a private message if you want to discuss your scenario in more detail. 

[alaugMSFT]

Hello, @Sachinbansal . 

This week. There is one outstanding update to make.powerapps.com happening in the government cloud this week which will allow sharing canvas apps with guests. 

Thanks,

Austin

[seadude]

Help me with this scenario:
- Large Corp A (50k O365 licenses) builds a PowerApp with Sharepoint lists as data source
- Corp A has security folks who will never grant guest access in AAD
- Small Corp B, C and D are all users of the app
- Users from Small Corp B, C and D can change daily (Bob is an employee today, gone tomorrow, now Joe)
How is a canvas app built by Large Corp A and the Sharepoint lists used by B, C and D?
Do not want “Portal” as a solution.

[alaugMSFT]

@seadude - This scenario isn't supported, guest access in AAD is a prerequisite for canvas app guest access.

If security folks want control over who can invite guests and what guests can access when they're part of the tenant then AAD external collaboration and AAD conditional access may provide the management capabilities desired by security folks.

As for sharing an app with users that change frequently, the app can be shared with an AAD security group and then new users can be added to the group (instead of having to reshare the app with every new user). 

[BegeNCSU]

I've encountered an issue when trying to share an app with a guest that isn't a google account (see Guest Access with Canvas App for the full story). In both cases, I've added the external user, added a PowerApps Plan 2 Trial license and shared the app with that user. The gmail account is able to run the app, but the Mailfence and Protonmail accounts return a "The app didn't start correctly.Try Refreshing your browser."

I've used different browsers (Firefox, Chrome) and I get the same error.

Session ID: 94b3641b-8fb7-4641-940b-bce6192df943

[arpost]

@alaugMSFT, can the license that gets added to a user when they access the app be removed after a user stops using the app?

[alaugMSFT]

Power Apps per user plans can always be re-assigned in portal.azure.com or admin.microsoft.com. Power Apps per app plans are assigned based on apps being shared with users - to remove this assignment the app must be unshared with the user. 

[arpost]

Ah. So there isn't currently any solution from Microsoft that supports an "auto-scale" approach that reclaims passes when a person stops using the app?

In other words, if you have 100 per-app licenses but only ever 50 concurrent users, you'd still need 100 licenses even if only 50 are ever active?

[arpost]

Oh, and forgot to say thanks @alaugMSFT for the prompt reply!