Power Platform access by guest users: unexpected behavior

[Korni1]

In our organization we wanted to try the guest sharing functionality in PowerApps and Flow, as described in the following article:

https://powerapps.microsoft.com/en-us/blog/share-canvas-apps-with-guests-in-your-organization/

But what we encountered a different behavior as expected, while sharing Apps to guest in our tenant.

Here is a description of our test:

1. We added the account to our Active Directory QA Enviroment.
2. Then we searched for the user in the sharing functionality of the specific PowerApps (QA tenant) as the original creator of the App.
3. We launched the hyperlink as the guest user.  
4. After authentication, we waited for few seconds for the login.

• The background color of the app was displayed for few seconds. Afterwards we received the folowing error message.

So since opening the very same App was possible with multiple other accounts on the same tenant. The App seems not to be broken, rather it seems to be there is an issue with the guest access or licensing.

Our first request here would be:

If the user did not have rights to open the app, an according error message shall be displayed.

We tested all this with different Accounts on different tenants with and without a license.

We are guessing here, but it seems like each guest needs to have a Microsoft tenant with a PowerApps and Flow license to access any other PowerApps and Flow in any other tenant, where he might be a guest.
In our opinion this limits any kind of collaboration planned with our customer, since we can’t expect guest to have a Microsoft tenant or even Licenses for PowerApps and Flow.  

So, is this guess correct? That means a guest needs to have a valid license on their own tenant?
Is this the expected behavior, in your point of view?

[abeldjilali]

I would say your analyse is correct, I've tested with inviting a user from tenant B ( with a license PowerApps in his tenant), I didn't assign a license to this guest in my tenant A, and the user is accessing to the PowerApp (Canvas) 

[Korni1]

Thank's for your opinion.  

An official answer from Microsoft about the guest feature would be really interesting for us.

[abeldjilali]

Please have a look on that https://docs.microsoft.com/en-us/power-platform-release-plan/2019wave2/microsoft-powerapps/share-app...

[alaugMSFT · Accepted solution]

@Korni1 - Thank you for using PowerApps and the canvas app guest access feature. A guest is expected to be able to access an app as long as they have a license in either their home or guest tenant. The team is currently fixing a bug that prevents Microsoft Account users (a non-Azure Active Directory credential for authenticating) from accessing canvas apps. We expect to have a resolution in production the week of Oct. 28th. 

[Testpowerapp]

I am using sharepoint list customized form with powerapp. The app is very basic and doesnt have any customized logic. When share the list /app with external users, i am getting the message "The app didnt start correctly. Try refreshing your browser" with Session ID: 38fd9fb5-8077-4d34-9cca-d2bea8efe744". Could you please help on this. Thank you

[abeldjilali]

Hello,

What about getting access to the canvas app as a guest user using the powerapps mobile app ?

thank you,

[Testpowerapp]

In our organisation, mobile app is restricted for external user. does the issue related to license. Since i had provided access to the sharepoint list to the external users and thatsall.

In my testing, i am following the "https://docs.microsoft.com/en-us/power-platform-release-plan/2019wave2/microsoft-powerapps/share-app...

point noted from above link - "If a SharePoint list has been shared with a guest user, that user can also run any canvas apps that are embedded in that list."

Could you please help. Thank you

[Korni1]

Thank you @alaugMSFT,

this helped us a lot!

So the bug was also the reason for the strange error message? 

[alaugMSFT]

@Testpowerapp - External users that authenticate with Azure AD can still access custom forms in SharePoint. The bug fix rolling out in the coming days will allow users Microsoft Accounts to access custom forms in SharePoint, again. Sans bugs, external users do not require a license to access a custom from in SharePoint. External users require a license any time they're accessing a standalone app, even if the app only connects to SharePoint. 

@abeldjilali - External users that authenticate with Azure AD can still access apps in PowerApps Mobile. The same bug fix resolving Microsoft Account access to SharePoint custom forms will allow guests with Microsoft Account to access canvas apps in mobile.

@Korni1 - Yes, the bug is the reason for the strange error message.