API to monitor Apps in PowerApps

[praveenvaltix]

Hi,

We are a startup building a network security service. Some of our customers are building apps through PowerApps. We would like to monitor the apps being built on behalf of our customers programmatically and retrieve metadata about the apps. Are there APIs and/or webhooks available to use to monitor the power apps usage by enterprises?

Thanks,
Praveen.

[EricRegnier]

Hi @praveenvaltix,

There is a "starter kit" aka accelerator to achieve just that. It's called the Power Platform CoE starter kit. Suggest to have a look at this, it will give you some tools, reports, data and insights to govern and manage your Power Platforms.

• https://powerapps.microsoft.com/en-us/blog/introducing-the-powerapps-center-of-excellence-starter-ki...
• https://docs.microsoft.com/en-us/power-platform/guidance/coe/starter-kit

Hope this helps!

[praveenvaltix]

Hi @EricRegnier thank you for a quick response and the pointer.

We are looking for REST APIs which we can integrate into our software. I was trying to understand from the links and I also downloaded the kit  here - https://aka.ms/CoEStarterKitDownload

It doesn't look like there are REST APIs. 

Can you please confirm?

[EricRegnier]

Yes there are quite a few APIs (and connectors) based on the component and your needs:

• Power Platform: Environment management connector https://docs.microsoft.com/en-us/connectors/powerplatformforadmins/. You can pull data from that with a flow and push to a destination system/database
• Power Apps app management connector: https://docs.microsoft.com/en-us/connectors/powerappsforappmakers/. You can pull data from that with a flow and push to a destination system/database
• Power Automate Management connector: https://docs.microsoft.com/en-us/connectors/flowmanagement/.  Same, you can pull data from that with a flow and push to a destination system/database
• Power Apps Admin connector: https://docs.microsoft.com/en-us/connectors/powerappsforadmins/. Again, you can pull data from that with a flow and push to a destination system/database
• CDS web api: https://docs.microsoft.com/en-us/powerapps/developer/common-data-service/webapi/overview. You can pull data like audit history of records, list of users, roles, etc.
• For CDS user activity and logs, CDS pushes data to Office 365 directly and you can get that data out of O365 with its activity API. Here's an article on this: https://cloudblogs.microsoft.com/dynamics365/it/2019/06/18/storing-common-data-service-activity-logs...

Hope this helps!

[praveenvaltix]

Hi @EricRegnier ,

Thank you for the detailed response. I do apologize in advance if my questions sound naive. Basically, we have a SaaS software stack written in Golang to deliver network security services (think WAF, IPS/IDS) in customer's AWS and Azure accounts by creating Azure Compute Instances running our Image in customer's Azure Subscriptions. Our current integration is based on invoking REST APIs through the Azure Resource Manager APIs and we internally use the Azure Go SDK - https://github.com/Azure/azure-sdk-for-go

These APIs are invoked on behalf of the customer and the integration is based on Active Directory application registered on behalf of Valtix in customer's Azure Subscription/SD. 

I looked through all the links that you provided, and I am unfortunately unable to map that into our current software stack. Our software is not Azure specific and doesn't run on any native Azure and Microsoft app platform. Having said that, I do believe as an example "Get Apps" - https://docs.microsoft.com/en-us/connectors/powerappsforadmins/#get-apps-as-admin command or API will serve the purpose we are looking for. We basically want to discover our customer's Apps built through PowerApps.

Can you please suggest any further reading or point me to something I am missing in my understanding?

Best,
Praveen.

[EricRegnier]

Hi @praveenvaltix,

They should still work with your software stack especially the REST APIs like the Common Data Service API. For the connector you can integrate with an intermediary component that I suggest, a Power Automate flow. For example, you can easily have a flow that triggers on a HTTP Request (or webhook) so you can call it from any technology stack, then have an action that gets the apps using the Power Apps for Admin connector and then sends a HTTP response with a json body. Here's an exmaple:

[praveenvaltix]

Hi @EricRegnier ,

Thank you for the clarification. The flow make sense when there is a trigger or a change in the apps.

Our use case is the following -

1) Our customer is using one or more powerapps in their environment.

2) Customer engages with Valtix to provide network security services for those apps. 

3) Valtix has to do a discovery of all the existing powerapps of the customer.

4) Customer creates new apps or modifies existing apps and Valtix should be on the notification path.

I am unable to map our requirement for 3) above to your suggestions to integrate with CDS with a connector. 

As an example, in Azure once we are integrated through AD with a customer's subscription. We have the ability to discover all their existing virtual machines. See e.g. below from the Azure Go SDK APIs -

https://github.com/Azure/azure-sdk-for-go/blob/master/services/network/mgmt/2020-03-01/network/virtu...

// List gets all virtual networks in a resource group.
// Parameters:
// resourceGroupName - the name of the resource group.
func (client VirtualNetworksClient) List(ctx context.Context, resourceGroupName string) (result VirtualNetworkListResultPage, err error) {
...
}

What is the equivalent Rest API or SDK or documentation for us to proactively to discover the power apps for our customer?

Best,
Praveen.

cc @praveenvaltix 

[EricRegnier]

Trigger doesn't have to be within the apps. For 3, Valtix will have to do some kind of script or scheduled / batch / recurring job to call the flow to get the apps. Have a play with it and suggest to do a little POC/prototype.

[praveenvaltix]

Hi @EricRegnier ,

Thank you for your suggestions. I was finally able to create the flow that you had described. Attached screenshots.

Having said that, the request is not succeeding when I trigger a http get. The error is in the "get apps as admin" stage from the flow logs.

See error string below - (I removed proprietary info).

"message": "The request failed with error: 'The environment '<null>' could not be found in the tenant 'XX'.'. The tracking Id is 'XX'.",

I have set the environment name correctly as you can see in the screenshot.

I am going to open a ticket but I thought I will let you know. 

Best,
Praveen.

[EricRegnier · Accepted solution]

Hi @praveenvaltix,

Glad to hear to the approach will work for you. Since you raise good questions, can you please mark the answer as accepted to help other users in the community?

Let us know what Microsoft ticket says, but make sure the user running the flow is either  "Global admin" or "Power Platform admin" in Office 365.

Cheers!