How exactly does sharing an app with connectors work?

[vangrieg]

Sorry for this question, it may look dumb, but I just can't wrap my head about how this works, and can't really test things for a number of reasons. I've been reading documentation, but the answers seem to be "it depends" and "users may need to do this and that". And I need to make some decisions based on whether my ideas are at all implementable or not. So, could anyone please enlighten me on what would happen if I share an app with the following connectors: 

1. SharePoint (every user of the app has access to the list). The app uses SharePoint lists as data sources. 
2. Office 365 users (every user of the app is a member, but hasn't set up any connectors and most don't even know what Office 365 is, let alone PowerApps and "connectors"). The app has several dropdowns populated by values drawn from Office365users connector. 
3. Salesforce "premium" connector. Every user of the app has access to Salesforce and has the rights to read the data I'm using. This connector is used to populate dropdowns with Account names. 
4. A custom connector to an external web service. Every user of the app has an account there, but the connector there is authenticated as me. I assume this won't work, but is there a way to call this connection from the app with my credentials? 

I have PowerApps Plan 2, every other user has the default plan that comes with Office 365 E3. 

So will users have to sign in to PowerApps and authenticate as themselves for each connector or will they be redirected to some web page where they need to fill in their credentials or will the app just fail? How does it work in real life? 

Thanks!

[v-monli-msft]

Hi @vangrieg,

1. The user must have the property permission on this SharePoint list. For example, if your users need to edit the items in this list from PowerApps, then they must be able to edit the items in SharePoint list directly.

2. To share PowerApps with Office 365 users connector, you only need delegated permissions. For more information about administrator roles, see Assigning administrator roles in Azure AD. About Permissions in Azure AD, please see https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-permissions-and-consent.

3. You just need to share the app, and users only need to create their own connections to the Salesforce data source in the app when accessing the app.

4. When you share an app that uses a custom connector, it is automatically shared, but users must create their own connections to it.

On powerapps.com, you can view or update permissions for a custom connector. In the left navigation bar, click or tap Manage, click or tap Connections, and then click or tap New connection (in the upper-right corner). Click or tap Custom, and then click or tap a custom connector to display details about it.

About sharing canvas-app resources in PowerApps:

https://docs.microsoft.com/en-us/powerapps/maker/canvas-apps/share-app-resources

Regards,

Mona

[vangrieg]

Thank you for your reply, @v-monli-msft!

I think I understand the situation with SharePoint, but the rest issues are unclear, just as they were when reading the documentation. 

First of all, I'm NOT and AD admin, and have no idea what permission level I have. Assuming other users of the app have the same permissions as I do, will they be able to use the app or not? 

Second, when you say they "need to create their own connection", what does that mean, from user perspective? They launch the app by clicking the link, and then what? Should they go to PowerApps settings and create all the connections there? Or can they just provide credentials in the app? 

[timl · Accepted solution]

Hi @vangrieg

To answer some of your questions, I gave this a quick test.

In terms of the AD permissions, I created a test user with the lowest permission available - 'User (no admin access)'. I was able to successfully share my app with an Office365Users connection, so I don't think that you'll have any problems here.

With respect to what users see when they load the app that you've shared, the first thing to point out is that the users with an Office 365 E3 PowerApps license won't be able to log in because E3 users don't have access to premium connectors (Salesforce is a premium connector). Instead, those users will be prompted to subscribe to a 'Plan 2 Trial'.
For users with a premium connector license, this is the screen that first appears when a user launches the app.

When the user clicks the sign in button, this is the screen that appears.

This is what Mona means by "need to create their own connection". The create button here opens a web page on the Salesforce web site that enables the user to authenticate. My Salesforce account has 2 factor authentication so this process also forces me to enter an email verification code at this point.
A similar thing applies for the custom connector.

The final thing to note is that if I click the 'Don't allow' button on the Salesforce connctor, my app loads and then it redirects to the PowerApps homepage.

Hope this helps you.

[vangrieg]

Thank you so much @timl for testing this! 

Now I can see how this works, finally. 

Even though it appears that I have to rethink everything I planned as nothing will work - PowerApps Plan 2 for every user in the company just to get a list of Accounts from Salesforce sounds totally crazy. 

I wonder if there's a way to disable premium connectors for some users but still allow the app to run? I guess not. 

Another thing that puzzles me is the authentication for the custom connector - what triggers it and how does that work? If I have Microsoft Flow authenticated using OAuth with a client/secret pair on an external service where I'm actually the only user, what kind of credentials are my app's users supposed to provide?