Permissions needed for external users to access Power Apps canvas app - SharePoint as the data source

[PowerAGuy]

Hello everyone,

I'm curious what permissions are required for an external user to be able to use a canvas app with SharePoint as the data source?

I have tried a few things but unable to fully get this to work. 

[Pstork1 · Accepted solution]

It depends on what the app does, but in general all they need is Contribute or Edit like any other user.  They do need to have a Power Apps license, either from their own tenant or yours.  Here's a good article on the steps required.

Share PowerApps to external users or guest users - EnjoySharePoint

[PowerAGuy]

Hello @Pstork1 

I have granted the external user permissions to the app, and permissions to the list only

Do I have to grant them access to the site?
As this is then a security issue, why would I want to share an entire site, be it as read only with external users.
But would explain why an error message such as the below appears for the user as I have not shared the site I have granted them SP permissions of contribute to the list itself :

[Pstork1]

It depends on what the app does, but in general you need to share the site if you are using things like Choice columns or lookups because the schema for those is stored at the site level, not the list.

[PowerAGuy]

@Pstork1 

Yes I have choice columns... 
what threw me off was when another external user was able to submit the form including the choice columns selected.... is sharing the site with the user the only way to achieve this?

I would need to see if someone else has shared the site with this external user then.

[Pstork1]

Yes, the user has to have a minimal access to the site if you are using Choice or Lookup columns.  The only other option for Choice columns is to hard code the choices in the control.  Its the available choices that the user needs access to at the site level.  So if you replace the use of Choices(datafield) in the Items property of the dropdown with an array or collection then the user should be able to use the app without access to the site.  The one problem is that this makes the choice list static and any change to the choices in the list won't be picked up automatically.

[PowerAGuy]

@Pstork1 

Thanks for the option, but the business makes too many changes so hard coding in values will not be the solution.

I did some digging, appeared the 2 users who could access the app were in the members group in SPO!

But now I have another external user who could not access the form with various errors all related to SPO authentication when they started up the Power Apps app, then they were granted access to another independent SPO folder in a different site, by another user and now appear to be able to fully access my app, it doesn't add up, as I cannot see any association between this other SPO site and the site where my data source resides. 
This individual whom it's working for only has limited access to just the list in my site!

The mystery continues!

[Pstork1]

If they have limited access to the list on your site, then they have limited access to the site itself.  Limited Access is always hierarchical.  The problem is you can't give Limited Access.  That is managed by the system.  So they need some access to the site, but only the minimum amount of rights.

[PowerAGuy]

Yes limited permissions isn't something you assign, I was highlighting that what they had, which relates to the permissions I had assigned that external user.
Could i grant the user access to the home page only, to resolve this issue of them not having access to the site and only the list.

The other strange thing was I got them to go to the SPO list and that too failed, so something is not right!

[Pstork1]

I can't say for sure.  Its dependent on what the app does and what columns you use.  I would think that limited access should be enough, which they will get if you give them access to the home page.  But the only way to know for sure is to do some tests with that specific app.