Office365Groups connector is not working on the published app

[Traconis1]

Hi everyone,

I have created the app and as an added functionality I added some controls only available to members of the specific security group.

In my App's OnStart property I included the following:

ClearCollect(DelegateUsers,Office365Groups.ListGroupMembers("56a53f4e-0000-0000-0000-000000000000").value);
If(User().Email in DelegateUsers.userPrincipalName ,Set(VarDelegate,true), Set(VarDelegate, false));
If(User().Email in DelegateUsers.userPrincipalName ,Set(currentUser,Blank()), Set(currentUser,User()));

I then added specific users to the security group (0's are just placeholders) and after the Azure sync I was able to test the app and it was working for each user.

I was able to confirm the collection (DelegateUsers) holds users visible on the AAD, I was able to correctly use VarDelegate and the currentUser variable was holding correct information.

However when I published the app and logged as the owner (and then as an non-owner and then as the standard user) the app asked for the Office365Groups connection (expected) but when the user clicked Allow - the app stopped working ie. the collection (DelegateUsers) was created correctly but the currentUser variable was set to blank.

Why the app works in edit and play mode but not after publishing. Are the non Owners requires some specific permission to be able to use Office365Groups connector?

[BCBuizer]

Hi @Traconis1 ,

According to you formula the currentUser variable is supposed to be set to Blank() when the current user is in the DelegateUsers collection, so that seems consistent with the behaviour you describe. Perhaps you want to reverse your If statement:

ClearCollect(DelegateUsers,Office365Groups.ListGroupMembers("56a53f4e-0000-0000-0000-000000000000").value);
If(User().Email in DelegateUsers.userPrincipalName ,Set(VarDelegate,true), Set(VarDelegate, false));
If(User().Email in DelegateUsers.userPrincipalName ,Set(currentUser,User()), Set(currentUser,Blank()));

[Traconis1]

Thanks for the response @BCBuizer , and I apologise for the confusion.

As I stated before, the app works perfectly fine in the design (EDIT and PLAY) mode but it doesn't after the app is published.

I should have mentioned, on the next screen that variable's value (currentUser) change to a different value so the above is just example what I put into the OnStart. In fact I can remove that statement from and nothing changes ie. the app still works in the development mode but not after publishing.

Supporting question - is there a "place" on our tenant (via GUI or Powershell) where I can check if all PowerApps functions can be accessed by all users (sorry if that make a little sense but not sure how to formulate that query).

My suspicion is that some PowerApps functions which "read" data from the Azure AD may not be accessed by each user. Ie. User() function will work for everyone but Office365Groups won't. 

Cheers

[BCBuizer]

Hi @Traconis1 ,

The only things that comes to mind is the Data Loss Prevention policies in the Power Platform Admin center where certain connectors may have been disabled for certain environments or security groups, but I don't have experience with that to really point you in the right direction...

[Traconis1]

Thanks @BCBuizer ! I checked the policy and it seems all connectors I used in the app are not blocked. I will raise it with the Microsoft Support - maybe I found a bug? 🙂

[BCBuizer]

Hi @Traconis1 ,

I gave this a second thought and you mentioned the DelegateUsers collection is properly populated, so the issue shouldn't be in the Office365Users connector or use thereof.

This leads me to believe the issue is in the logic you are using to set the variables. Did you also test the co-owner and user scenarios in when the app is in edit mode?

[Traconis]

Thanks for the response.

I tested the app in the Edit mode as:
Owner - the main service account with E5 licence

co-owner admin account - admin account without the licence but with near full Microsoft 365/Azure access

co-owner user account - standard user E5 licence account

In each test I was able to fetch the data according to the security group permission i.e.:

Service account is a member of the security group (Delegate users) as well as it has an email account etc. (E5 licence) so was able to use all properties later in the app - to compose email, display name etc.

admin account - member of the security group but without licence so I was able to do the same as above but without those features which requires user's email.

regular account without membership - the app correctly identifies the user without delegate access so it navigated to the correct screen hiding relevant controls as expected.

But everything above just works in the EDIT mode only :(. As soon as I publish the app, all users are asked to create/refresh a new connection (Office365Groups - as expected) but after doing that the app always returns

Set(currentUser,Blank()));

regardless if the user is in the security group or not. As a result the rest of the app functionality fails because it is not able to correctly identify the user.

Right now I reversed the app and removed/commented that part of the code so all calls to the currentUser variable are replaced with User() which works perfectly fine.

I still browsing the depths of the Internet to see if there is another way to allow delegation if the above doesn't work.

The logic (IMHO) is dead simple.

1. User can be a member of the security group called 'Delegation'

2. User sign in to the app

3. The app check if the user is a member of the security groups

4. If False assign the User() to the variable currentUser and use it throughout the app.

5. If True - display a table with all user's names and allow to check one

6. Assign the above choice to the variable currentUser and use it throughout the app ie. update the Sharepoint list with the currentUser.Name or send the email to currentUser.Email etc.

[Traconis1]

Sorry @BCBuizer - the above is my other account (not sure how to link both of them 😞 )

[BCBuizer]

Hi @Traconis1 ,

Indeed this should be something really simple. And usually when it's something really simple but not working, it's because of some little detail that is overlooked. What you may consider is to add controls to the app which are only visible for certain test users and display the values of: DelegateUsers, VarDelegate and currentUser.

This allows you to compare the actual value against the expected value at certain points in your app after publishing.

[Traconis1]

Thanks @BCBuizer ,

So far I was just watching variables and collections using built-in menu as well as looking at the input&output on the monitor. Your solution is the best, however most time consuming but looks like it is the only way to find this little error. The problem is the app can't be taken down for longer than 1-2 hours and I don't have resources to provision it in a separate environment for a different set of users :(.

I will follow your guide as well as reporting this to Microsoft at the same time (time critical) and provide updates here (looks like an isolated issue but I don't want to think my app is so sophisticated that nobody else encountered the same issue).

Brb!