PowerApps offline app issue: Cannot launch app that hasn't been recently launched online

[wyotim]

In continuation of this thread, I am posting regarding an issue with opening apps while offline. If an app has been opened online recently (it seems to be less than 24 hours but I am not completely sure of the amount of time), it is possible to open the app offline. Otherwise, it will throw an error "This app didn't open. Make sure you're signed in and that you have internet access." (Which I can't argue with because there isn't internet access and the app definitely didn't launch.   ) 

As I alluded to in that previous thread, this has historically been across all platforms but testing my iPhone just now I was elated to find that I could launch every app, even ones that I haven't opened for some time. Happy days! I don't have an Android device to test today but on the Windows 10 app, it behaves as described above. Is this issue known/being worked on by chance?

Tagging @Chris and @claudiosvcc for this. Thank you!

[Merlijn]

Isn't this just a security feature to prevent unlicensed users to use PowerApps?

[Chris]

This is likely related to the lifetime of the auth token which is configurable in AAD by your admin. As a workaround you could try extending the auth token lifetime.

[wyotim]

@Chris I will look into that and report back. Thanks for the info!

[wyotim]

@Merlijn In conjunction with what @Chris posted, you could be correct. I'll report back if it is an AAD token issue. Thanks!

[wyotim]

Unfortunately for us all , I am the admin for all our services (working for a small company requires many hats!). I have very much to learn on the Azure end. So employing some Bing-fu (Google-fu's lower market-share cousin) and using this info, I created a policy with the maximum times and applied it to the PowerApps Service. Here is my PowerShell code for reference, just in case (1) this works and others want to use it or (2) I messed it up completely and someone can point out my errors:

// After connecting PowerShell to our Azure AD...
//  Setting up a new default policy using the default values for each property
//
$policy = New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"MaxAgeSingleFactor":"until-revoked", "MaxAgeMultiFactor":"until-revoked", "MaxAgeSessionSingleFactor":"until-revoked", "MaxAgeSessionMultiFactor":"until-revoked", "AccessTokenLifetime":"1.00:00:00", "MaxInactiveTime":"90.00:00:00"}}') -DisplayName "OrganizationDefaultPolicyScenario" -IsOrganizationDefault $true -Type "TokenLifetimePolicy"

// I then verified that the policy was created using the following
//
Get-AzureADPolicy -Id $policy.Id

// Next I looked at the list of services so I could find the ObjectId for PowerApps...
//
Get-AzureADServicePrincipal

// ...which showed me that the name is PowerAppsService, which I set to $sp
//
$sp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'PowerAppsService'"

// Then I assigned the policy to the service
//
Add-AzureADServicePrincipalPolicy -Id $policy.Id -RefObjectId $sp.ObjectId

// Lastly, I verified that the policy was applied to the service 
//
Get-AzureADServicePrincipalPolicy -Id $sp.ObjectId

I will note that there were no policies set up in our AAD so, if my understanding of things is correct, the default values should have been in play this entire time. Also, the default values are the max for all but the Access Token Lifetime, so I went ahead and bumped that up to the max of a day instead of the default hour. 

So far, it seems to be behaving the same where apps that I have launched online recently worked and apps I haven't launched recently did not work. After launching apps online, they worked. I'll check again on Monday to see if the behavior has changed.

[wyotim]

Apologies for the lack of reply here; things have been a bit busy. Extending the lifetime of the auth token to the max amounts has had no effect on the Windows 10 version. Android and iOS behave as expected though (as they did before this attempted fix). Anything else that I can try?