Deploying Power Apps, General and External User Issues

[Tim_RA]

Hi Everyone,

We've wrapped up development of our power app and are running into multiple issues making it available to our users. I have looked at many resource pages and walkthroughs, and have been unable to identify where things are going wrong. First, some context:

• The app is a Canvas App
• Data comes from tables in the Dataverse
• App includes Power BI report elements

We have run into issues at every stage of the deployment. Not sure if they are related or not so i'm listing everything here, but let me know if I should break these out into separate posts.

1. Each time I access the power app within Microsoft Power Apps (with my creator/admin account), I am asked to go through TFA authentication FOUR times. The system even asks me to come back again later as I hit my limit on text verification codes, so I end up signing in four times with second authentication via text, call, text, call to access the app. This cannot be the expected UX?

2. Once i'm finally logged in to the app, the power BI report elements fail never load. The power BI icon just pulses endlessly. The report elements are created/shared through my (creator/admin) Microsoft Power BI Pro account and load fine when i'm looking at the app in the make.powerapps environment.

3. Our anticipated users are guests in our environment. This is a very simple app - four users to add, update, and review records plus reporting on some data. I invited them to our environment in the Azure portal. I added their Usage Location as United States. The goal is that they should each access via single app user plan ($10/user/mo). I assigned them each a license for Microsoft Power Apps Plan 2 Trial with all four elements active (Common Data Service, Flow Free, Flow P2 Viral, PowerApps Trial). They each received an invitation to our environment as expected. I then shared the app directly with each user from the power apps interface, granting them basic user access to the Dataverse entities.

The users are able to open the link via the email shared with them, but the app falls short in two ways:

1. The app does not appear in the "Power Apps" application. The only way the users can open it is via the email link.
2. The app errors when trying to access the dataverse data (i.e. selecting from a populated drop-down). Here is the error:

"You don't have permission to view this data. Server Response: Customers failed: Principal user (Id=b75e8a8f-a5cf-eb11-bacc-0022481f6861, type=8, roleCount=1, privilegeCount=411, accessMode=0), is missing prvReadcr5ed_Customers privilege (Id=ddb5851e-ddc9-463e-8ed3-ceaf17744bdc) on OTC=10138 for entity 'cr5ed_customers'. context.Caller=b75e8a8f-a5cf-eb11-bacc-0022481f6861"
 

We created our own guest user account to troubleshoot these issues and have not been able to make any headway. 

Bonus Question: If I embed Power BI report elements in a Power App, will each guest user then need a Power BI PRO license on top of the Per App license cost?

[Pstork1]

I can't help with all your questions, but can provide input on some of them.

1) Guest users must be added to you Azure AD.  They will also need a Power Apps license either from your tenant or from their own Office 365 tenant.  Simply giving them guest access to something in your environment will not make them a full B2B user in Azure AD.  They must be registered as a B2B user. see: Share a canvas app with guest users - Power Apps | Microsoft Docs

2) Once they are in Azure AD as a B2B user you will need to give those accounts appropriate access to Dataverse.  Power Apps is not a security layer and does not do impersonation.  Users need permissions to the data source itself in addition to permission to run the app.  Your error would suggest that user's don't have the access they need in Dataverse.

3) External users will be logged in to their own tenant on their client and that is where the list of apps will come from.  Apps from external tenants don't show in the client.  The only way to access them is through the link that you shared.

4) Check with your security administrators about the issues you are having logging in.  That isn't really related to Power Apps, its the way your Office 365 environment is configured.  Multifactor authentication does tend to cause some issues with Power Apps configuration.

[Tim_RA]

1. Yes, I have completed setup for our guest users in Azure AD.

2. I am not finding resources that mention a separate Dataverse security configuration setup. Can you direct me to a relevant resource showing where this can be done?

3. Really? Wow. You're right, and that's shockingly broken. I can't imagine a scenario where that is an adequate solution for guest users. Really surprising given Microsoft's general support of the partner model.

https://www.linkedin.com/pulse/powerapps-mobile-app-limitation-guest-users-cannot-access-baimbi?arti...

[Pstork1]

1) I figured you had, but wanted to be thorough

2) For the security piece take a look at the following:

Security in Microsoft Dataverse - Power Platform | Microsoft Docs

User's need access to Dataverse tables the same way they need access to SharePoint or Excel files in OneDrive when those are used as a data source

3) The mobile client was originally designed for internal users.  The ability to share externally was a later addition.  Not sure if the client will ever really work with external tenant apps.  I suspect it would require a complete re-design.

[Tim_RA]

Regarding 2): Okay I found the environment in the Power Platform Admin Center. The users that shared the app with are listed, and the appear to be assigned to the correct security role (Basic User) as I assigned when sharing the canvas app. We don't have any complexity with business units or row level security. Where should I look for the next layer of permissions to the dataverse tables that you are referring to? I checked the security diagnostics for one of the users and everything seems good:

Access mode: Read-Write

Status: Enabled

Results + fixes:

This user is allowed to sign in.

This user has an active license or the environment has per app plans.

This user is a member of the environment's group.

[Pstork1]

I don't think Basic User is going to be enough.  Take a look at the following.  As a Basic User they will only have access to records they created and ones specifically shared with them.  Security roles and privileges - Power Platform | Microsoft Docs.  Unless you want to create your own custom role I think you'll need to assign the users Service Writer.  Configure user security in an environment - Power Platform | Microsoft Docs