Apps needing permission to use data connectors

[Greg27]

After creating my first app, I shared the app with an end user. That user clicked on the link in the email they received and they were prompted with the following:

Almost there...

<App Name> needs your permission to use the following. Please

allow the permissions to proceed.

SharePoint

User's email address                                 Switch account

Signed in View permissions

Azure AD

Connection by Microsoft                          Sign in

Office 365 Users

User's email address                                 Switch account

Signed in View permissions

I am not sure why the end user is prompted to allow the use of connectors as that should be something that we as developers setup. As a developer, we give permissions to what they need to access and they can just access the resources. This is the first time that I have seen an end user having to allow for something that, I as a developer, have already granted them access to. Is there a way to keep this popup form showing up and just allowing them direct access into the app?

[Pstork1 · Accepted solution]

Power Apps is not a security layer.  Users will need whatever permissions are required by the app to the data source.  That fact is clearly stated in the documentation.Share a canvas app with your organization - Power Apps | Microsoft Docs There are ways to auto accept the popup using a PowerShell setting, but the user still needs to be logged in and have the correct permissions to the data source.  Suppress User Consent Popup in PowerApps - Cloud Decoded (anupams.net)

[Jeff_Thorpe]

If the connection needs to use the user's credentials to connect to the data source then the user needs to give consent. This is normal behavior in apps that use these type of connectors. There are some connectors that use implicit sharing where a credential is stored in the connection, so it doesn't use the user's credentials and therefore the user doesn't have to give consent.  You can bypass the user consent for an app by using the PowerShell command Set-AdminPowerAppApisToBypassConsent .

[Greg27]

I understand that users need to login. That's totally expected. They have access to write to the SharePoint List that the app writes to and, if they are using the app, they need to pull in names and email addresses from Azure/Office 365. The user that got the popup that asked them to allow access to SharePoint, Azure AD, and Office 365 Users was already authenticated to Azure AD as we use SSO with Azure for almost all of our systems. If they were logged into Azure AD, is there a reason she is being asked to login again? Is there a way to tie SSO into our Power Apps?

[Pstork1]

The Popup should only happen the first time the user runs the app.  Since you are using SSO they should be able to just click on the prompt and it will log them in.  But whether they are logged in or not the Popup will come up the first time any user runs the app.  As mentioned in a previous post you can use PowerShell to auto accept the prompt and not display the popup. But that is the only way to avoid the prompt.

[Greg27]

The PowerShell command worked perfectly, but it still comes up with the Azure AD connector because users are not authenticated. The app doesn't seem to recognize that we are using SSO. Should I create a different question to see if there is a way that we can keep Power Apps from showing the Sign in button on the Allow pop up:

Azure AD

Connection by Microsoft                          Sign in

If Power Apps works with SSO, do I need to configure anything else? If this should be a new question, I will go ahead and close this question and create the new one.

[Pstork1]

Posting it as a new question will get you more responses.  But I don't know any way to get around the prompt other than what I've already mentioned.  When they click on the prompt does it actually prompt them to login with a userID and password?  Or just log them on in the background using SSO?  I guess I'm expecting the second to the be case and I don't think there is any way around that.

[Anonymous]

I'm currently trying to do the same - did you manage to solve this issue at all? Thanks

[Greg27]

@Anonymous 

I stopped using the Azure AD connector and use the Office365Users and Office365Groups. I also ran the PowerShell script and it seems to have worked.

Would you let me know if it works for you?

[Anonymous]

Thanks for your quick reply, Greg. Unfortunately, I'm stuck with using Azure AD to manage my users in this instance, so will look for another option. Thanks!