Power Platform access by guest users: unexpected behavior

[Korni1]

In our organization we wanted to try the guest sharing functionality in PowerApps and Flow, as described in the following article:

https://powerapps.microsoft.com/en-us/blog/share-canvas-apps-with-guests-in-your-organization/

But what we encountered a different behavior as expected, while sharing Apps to guest in our tenant.

Here is a description of our test:

1. We added the account to our Active Directory QA Enviroment.
2. Then we searched for the user in the sharing functionality of the specific PowerApps (QA tenant) as the original creator of the App.
3. We launched the hyperlink as the guest user.  
4. After authentication, we waited for few seconds for the login.

• The background color of the app was displayed for few seconds. Afterwards we received the folowing error message.

So since opening the very same App was possible with multiple other accounts on the same tenant. The App seems not to be broken, rather it seems to be there is an issue with the guest access or licensing.

Our first request here would be:

If the user did not have rights to open the app, an according error message shall be displayed.

We tested all this with different Accounts on different tenants with and without a license.

We are guessing here, but it seems like each guest needs to have a Microsoft tenant with a PowerApps and Flow license to access any other PowerApps and Flow in any other tenant, where he might be a guest.
In our opinion this limits any kind of collaboration planned with our customer, since we can’t expect guest to have a Microsoft tenant or even Licenses for PowerApps and Flow.  

So, is this guess correct? That means a guest needs to have a valid license on their own tenant?
Is this the expected behavior, in your point of view?

[simb55]

---

@Raynok1 wrote:

So technically they opened an internal Powerapp before attempting to opening the external Powerapp via the launch button

---

Exactly!

---

@Raynok1 wrote:

we'll never know if its done first either by opening apps or when closing an app or creating an app first

---

In fact, I can confirm that OPENING the app does the trick.

Creating apps works as well, because yeah, when you create an app, you are basically also opening one.

---

@Raynok1 wrote:

Could even be time period between account creation and attempting to to open the external app.

---

After my tests, I can rule this out. A user who existed in the tenant for an eternity showed the same behaviour as a freshly created user.

The workaround is in no way optimal, sadly.

Also it requires direct acces to the target external tenant, and if this is not given, the Export/Import feature which is currently in preview but will become a premium feature once the preview phase is over. 🙄

I really hope for a fix on Microsofts side.

[Raynok1]

Thank you. Yes at scale and across multiple tenants being serviced, it is not optimal. 100 % with you on this. Out of interest how you addressing the bulk guest import into Azure? The ability to do so is no longer available, so right their is another hurdle to the experience.

Hope you not serious about the export/import will be a premium service. I'm still wounded by the SQL connector going premium. 

1.) Bulk guest user import - No Longer available.

2.) Existing and new users - Have to open an internal Powerapp as a workaround to open external apps for the first time.

3.) External apps do not show directly as a listed app in Powerapps mobile app and Powerapps web app. - A Powerapp with launch buttons pointing to external app is the workaround. 

@alaugMSFT  -  This effects every Powerapps maker with these requirements. Safe to say its the world. 

[alaugMSFT]

We're actively working on a 'tenant switcher' which would allow end-users to select the tenant for which they want to see apps. Until that is available, yes, end-users will need to access an app by using the full app link. 

[simb55]

Hi alaugMFST,

thanks for your response.

What do you mean by 'full app link'? Is this the link we can find on the 'Details' screen of our apps?

[Raynok1]

@alaugMSFT  - Thank you for the feedback. Yes I imagine something similar to how we switch between tenants in Teams.

[Raynok1]

@alaugMSFT - Slight off topic but if you going to go code the tenant switching ability, the Powerapps developers might as well give us a hide function.

We want to reduce the amount of apps listed in the powerapps mobile/web app by creating a master Powerapps that has launch buttons to other powerapps and hide the rest. 

Yes, we can mark one app as hero app but it'll be great to hide the rest. Fantastic option if hide was available.  

[alaugMSFT]

@simb55  - You're correct, the app link that can be found in app details in https://make.powerapps.com. 

[alaugMSFT]

@Raynok1 - I appreciate the feedback. Have you posted this in the ideas forum? I've observed a few requests on enabling different types of app discovery/app listing experiences. If there's enough interest in a specific app list filter it makes prioritizing the investment easier - the ideas forum is one of our signals for measuring interest. 

[simb55]

Hi alaugMFST,

I have just tested this again. Still the same result. A freshly created user which I assigned an E5 license cannot acces a PowerApp on an external tenant, not even via the direct link from the app details page. He still gets the licensing error, unless he opens a PowerApp in his own tenant first.

[alaugMSFT]

@simb55 - will you send me a private message with at least one of the following, please?

• A sessionId where the user gets a license prompt
• the application id where the end-user is receiving the license prompt.