Concern on authenticating Office 365 outlook when accessing our PowerApps form

[Anonymous]

One of our users has a concern about authenticating Office 365 outlook when accessing our PowerApps form.

In the attached Screen 1, it asks user to allow..but when you click on View permissions, the second screen appears and user is more concerned about read, update and delete your mails.

This screen appears when clicking on view permissions and the user is not comfortable to 

My questions?

1) Is there a way we can disable these popups for end-users?

2) I know this is normal behavior as its simply asking user to allow Office 365 as this connection is is used for sending an email, but why the message says "this app will be able to read, update and delete your mails"

[Anonymous]

Not that I'm aware of. I think all you can do is assure them that apps won't delete emails unless that's part of a workflow. If it's not, the app won't just randomly delete their mail. This is no different than granting permissions to many other email apps.

---
If this answered your question, please click "Accept Solution". If this helped, please Thumbs Up.

[abdullah1854]

Hi, 

can you please go through this link once?

https://poszytek.eu/en/microsoft-en/office-365-en/powerapps-en/end-user-receives-pop-up-asking-for-p...

and a more detailed docs by microsoft about using powershell 

https://docs.microsoft.com/en-us/power-platform/admin/powerapps-powershell

Best regards,

Abdullah

[Anonymous]

I told the user the same thing, however she was not convinced with my answer as the message clearly says..it can read, delete, copy your emails.

[v-yutliu-msft]

Hi @Anonymous ,

1)I'm afraid it's not supported to disable these popups for end-users.

Since your app has connected with these connectors,like office365 outlook, every time user open this app, this popups will show automatically to ask for permission.

2)Please tell your users not to worry about this.

The popup shows these information is because that this office365 outlook connector support these functions: read, update and delete your mails.

But only when you use formulas about these functions, you could read, update and delete your mails in the app.

Also, you need to act the action that has formulas about these, then you will read, update and delete your mails.

If you not use these functions, office365 outlook connector will not read, update and delete your mails automatically.

Best regards,

[Anonymous]

Thanks for the reply. 

I understand these actions will happen only when we write a code to delete or retrieve emails. However, it's very hard to convince the end-users that we are not using any code or script for the same. They wouldn't even understand if I show them the code.

Can someone from the Microsoft PowerApps support team confirm the same? In that way, at least I will some official words that this message is very generic and this will be applicable only when we write a code to delete the emails.

[AndrewC]

Isn't this how we got into the XP virus problem.  Trusting the code.   A malicious developer can wreak havoc.

Any app that can read, delete, or send an email must fully disclose that, and that can't be hidden behind a link . At minimum we need to do:

• the permissions message must be a combination of the connector’s capabilities and the actual connector code used in the app (obviously, if the permissions change, the end user must re-approve).
• the permissions must be displayed and not hidden behind the link

Microsoft users need to be able to trust the apps. Full disclosure is the best way to do this.

Andrew

[MarkVeu]

I couldn't agree more @AndrewC !

Does anybody know if this is somewhere on the Microsoft roadmap to make it possible for the PowerApps developer (or should i say PowerUser) to select more fine grained the explicit permissions the connector is using in the specific App?

Living in 2020, seeing the news with one data breach followed by the other , this should be a top of mind issue i think.

[AndrewC]

How does the end-user know:

"...,If you not use these functions, office365 outlook connector will not read, update and delete your mails automatically.:"

The point here is I can't protect my enterprise from a malicious developer unless I disable the connector, and thus preventing my citizen developers from using PowerApps.

Andrew

[Anonymous]

Hi AndrewC,

What I struggle with is how the Outlook connector adheres to the basic security principle of least privilege.  Let's say for example, you have a Canvas app that just wants to send an e-mail notification - why would it need the ability to delete and read e-mails etc.?  If there are just binary permissions for the connectors of all or nothing, surely this is a flaw with the app itself?

The question is does the PowerApp have the ability/potential to do these things - whether it actually does them or not is irrelevant in my view.  It's the attack surface it presents to any potential hackers etc.