How to restrict "Power App Per App Plan" pass assginment to specific premium apps in an environment

[Ammar97]

I have 5 premium canvas powerapps in the default environment. Only one of these was developed by our main development team, whereas the rest of them were created by citizen developers.

I purchased a "Power App Per App Plan" license for testing purposes, which I assigned to the default environment through the add-on capacity. 

As soon as I assigned this single license to the default environment, I noticed all the apps (premium and standard) got the 'Auto Assign Per App Passes' enabled under the section 'Pass assignment​' (which can be seen by selecting an app and clicking on settings). 

Then I randomly tested with several users and they all can access all these premium apps without any warning for extending the trial. The moment I disable the option 'Auto Assign Per App Passes' from an app, users see the warning for extending the trial. If I set the setting back to enabled, users can work again.

As per Microsoft's licensing documentation, in my case, the total number of licenses assigned to this environment should be 50 (as there are 10 users and each one is accessing all 5 premium apps).

But what I observed is that with a single license assigned to this environment, all 10 users can access all 5 apps.

My questions are:

1. How is it possible that one license of $5 gives multiple users the ability to access multiple premium apps?

2. Considering that the users may face limitations at any time, I want to buy only 10 such licenses which I want to assign to the app which was developed by the main developers.  So, how can I restrict other citizen developers from enabling the setting 'Auto Assign Per App Passes' in their apps?

3. If I purchase and assign 10 such licenses to this environment, and in case the number of users accessing the main app increases to 20, when and how would they face restrictions/limitations/warnings? 

Any suggestion would be highly appreciated!

[joe_hannes_col]

Hello @Ammar97,

You are correct, one per app pass should only grant access to a single app.

In your situation, you have relatively little control on how citizen developers behave - in this case regarding enabling app pass assignment to their apps - because this is taking place in the default environment. In the default environment, all citizen developer have the "Environment Maker" role, which gives them the ability to enable app pass assignment.

Apparently, they are developing apps that are used by multiple users, and not just for their own personal use.

So my suggestion would be a different approach to governing your environments:

1. Designate the default environment as an environment for personal productivity only, not for solutions that are meant to be used by whole teams. This is also a best practice recommended by Microsoft.
2. If citizen developers want to develop solutions used by whole teams, set up one or multiple developer environments for this purpose. Citizen developers can have the Environment Maker or even the System Administrator role in this environment.
3. For productive use of these solutions, set up one or more production environments, and import (automatically through Pipelines or manually) the solutions into this environment. Make sure that the citizen developers do not have a security role that enables them to edit apps in this environment, e.g. "Basic user", while you have administrative privileges. This way, only you (and other admins) can set which apps can consume per app licenses.

While this requires some setup, it will allow you exact control of not only licenses consumed but also access to data, for example, and it will pay off in the long run.

So, coming back to your questions:

1. Sloppy enforcement on the part of Microsoft most likely 🙂
2. I'm not aware of any way in the default environment.
3. Whenever this is enforced by Microsoft. You can monitor the consumption of per app passes in the Power Platform Admin Center.

[Ammar97]

Thanks a lot Joe for the valuable input. You really understood my situation correctly.
My next step would be to handle this situation using a new Production environment with controlled security roles.
I wish MS provided a centralized way of handling the Per App Plan licenses.