Understanding Permissions Model - Power Apps with SharePoint

[audrieg]

I would like help understanding the permissions model. I am assuming that sharing an app, is very much like sharing a document. The very act of sharing a document, gives the recipient of the share access to it. However, since we can often integrate connections/flows that query and update more than 1 datasource, I'm confused on how to manage sharing so that my users are not seeing blank controls. Would you please help me...

Which one of these is true?

A. When I configure a connection to a SharePoint site using my credentials for a data source, then the app will always use my permissions to access the data. (I assume if I leave the company the access will be denied, so maybe we'll want to set up an account where the password doesn't expire specifically for power apps?)

B. Even though I configured my connection to a SharePoint site using my credentials, the app will still use the consumer/end-user permissions to access the data while they are running the app.

C. I have the option to configure connections through my own account, or to make it dynamic (which will always leverage the users credentials).

D. End Users of Power Apps will need to have a Power App license in Office 365, even if they just use (but do not create) apps.

Also, if you can point me to any documentation on permissions/authentication requirements (especially for sharing apps), I would appreciate it.

Thank you so much! I'm really enjoying this app a lot!

Audrie

P.S. The problem I am trying to solve for is that I shared an app with a user connected to SharePoint (where they have contributor access for the whole site, and where the 4 lists that are being used by the app are inheriting permissions). However, when using the app, they could not see the list items in the browsing gallery, and when they tried to add a new item, form submit resulted in a red message "an error occurred on the server". On the other hand, when I use the app (I am the global admin), it works as expected. I don't want to elevate her permissions higher than what is needed, hence my question above.

[jo · Accepted solution]

Hi Audrie,

RE your question "does each 'user' comsuming the apps need to have a PowerApps license, or only those who are building them?" 

In the current PowerApps preview, a user must have a PowerApps license in order to consume an app.

As you call out, our preview license is free and can be obtained by following the steps here: https://powerapps.microsoft.com/en-us/tutorials/signup-for-powerapps/#sign-up-for-powerapps-1.

James

[audrieg]

Thank you for your direct answer (even in preview mode). IMO that may prove difficult to manage if these licenses ever go to a pricing model, since at that point I would assume only certain tenant admins can provide users a license.

Please understand that my persona includes the fact that I am also an InfoPath Developer, and am looking to use this in a way similar to how I used InfoPath - which did not have any licensing complexities - only site level requirements. Imagine if InfoPath developers had to contact a tenant admin to get a license added on the tenant level first for all of their users (I don't know if I would appreciate having to have users go to a separate website to sign up before using it either - but I could see that is where we are today.) In my case, I have been creating beta testing log-ins and signing up for them. Looking at the other possibility, which is worse IMO, imagine if licensing which is 'at some cost to the tenant', was in the reach of the end user and they could get the licenses they need through a UI (like the link you provided)....imagine how quickly that could spin out of control from a budgeting perspective.

IMO the license should only be required for "app builders", but not each and every app consumers (which will go into the hundreds/thousands in many cases). (IMO it would be cool to have an 'app builder' group for departments, and the group could be given the license, this way app builders would have an instant network to rely on, and could be dropped out of the group to remove the license for their account.)

I sincerely hope you don't mind me bringing out these concerns, as someone who works with many customers in the Office 365 space.

Thank you again for your direct answer! I really LOVE all the power communities, and am only worried about how pricing/licensing might impact engagement. So far, the potential is HUGE (it's a win/win as regards functional specs), but it's very hard to present to my customers a clear picture of maintenance, support, and cost planning.

Audrie

[jo]

Hi Audrie, 

We totally understand and recognize your licensing concerns below, thank you for the feedback! 

Once piece of information that should hopefully alleviate some of your concerns below is the fact that PowerApps will be available (for no additional cost) in some of the Office 365 plans when we launch our service. Our goal through including PowerApps in these plans is to avoid the very same concerns you are raising below around adoption of apps by "app consumers."

The details for this were announced in the our "CE341 - Expand the value of your existing solutions business by adding an app practice by Microsoft PowerApps" WPC session last month:

1. CE341.pptx - see slide #15
2. Video of the session can also be found here https://resources.wpc.microsoft.com/#key=searchTerm&value=Ce341 - see 54:30

The specific details around which Office 365 plans & pricing are not yet available, but I will reply back to this thread once they are available.

Thanks,

James

[audrieg]

Thank you so much for providing these details and understanding my concerns. I'm going to watch the presentation today and keep the deck as a reference in an effort to mitigate any risks.

Audrie

[audrieg]

I watched the presentation and agree that this is a HUGE opportunity and a great strategy! I am deeply engaged with all the Power Communities, with the biggest focus on helping businesses to discover insights (through Power BI) and facilitate internal processes (through workflow and forms).As I see it now, Power BI is the most mature (and works wonderfully even all by itself), with Power Apps coming up to production-ready state very quickly (IMO). (I'm CRAZY about Power Apps! The only real problem I have with it right now is the lack of support for terms (in the enterprise term store), or managed meta-data column usage. In cases, where I want to push app usage across an entire tenant, I need something like that that persists for search and discovery purposes.)

However, Flow, which IMO is a dependency for optimizing the value of Power Apps, is dragging behind. There are a lot of unexplained failures in the execution of flows (even when they run successfully many times). In these cases, support responds often (if not always) with "we know, we're working on it" (which really doesn't help much). So I see Flow as a bottleneck in many cases. On the other hand, if Flow catches up to it's big brothers in reliability, I am convinced this will create a package of revolutionary business tools.Thank you for hearing us, and being open to consumer feedback.

I have all the confidence in the world that Microsoft won't let their partners down. You've always given us plenty of wonderful services to build upon!

[jo · Accepted solution]

FYI: with today's announcement of general availability of the PowerApps service, our pricing details can now be found here: https://powerapps.microsoft.com/pricing/

[Ianbudson]

I know this is a really old post but did you ever figure out the permissions part of it. I am experiencing the exact same thing right now only with a few users. Most folks can access and use the app fine, but three people so far get permissions hours even though they have full access to the SharePoint list and sites. I’ve tested all that works fine