How to use the principle Management identity account inside PowerApps Canvas app as the data connection account to connect SharePoint online lists

[kathyOne]

1. Current issue

We currently are using PowerApps Canvas App to connect to SharePoint online lists by using a service account which means this account is an Office 365 account and uses a unique username and password. but our organization just put the security policy there we must use a Service Principle account, for this kind of data connection, due to security concerns.  

1. Actions we have taken and issues:

We started to add the Principle service account into PowerApps environments as the application user account, but  when we add this account as a new connection, a popup screen for login appears, still need username and password or security key.  And the account we add does not have an email address, password. We have done some web research, and most of resources posted for setup principal service account is for Power Automate and for Dataverse (like this A Visual Guide To Power Platform Service Principal Setup (matthewdevaney.com).  For our scenario, we are not using Dataverse, we want to use SharePoint Online lists as a backend database and PowerApps Canvas App as interface.

Question

1. if  it can set up the service Principle user application account (No password and email address) for PowerApps Canvas and we can use this principle application user account to connect with SharePoint online lists as the data source. If yes, what are the steps.. 

Really appreciated all your help, if we cannot figure this out if we can setup an service principle user account for canvas app to SharePoint online connection, we need redesign the solution by using spfx not able to use PowerApps canvas app. Initial we choose Canvas app and SharePoint online just because this is an existing 2013 version of SharePoint application with customized JavaScript and sandbox .NET solution code, it is easy to migrate to SPO online with same data structure, instead of Dataverse. For interface, we choose PowerApps Canvas app, thinking it may be less code development than SPFX solution. 

Kathy 

[Devvj]

Hi @kathyOne 
I hope I'm wrong about it, but i'm fairly sure you can't tie a Service Principle to the SharePoint connector, you however can do that against some other (Premium) connectors like Dataverse.

-------------------------------------------------------------------------
If this is the answer for your question, please mark the post as Solved.
If this answer helps you in any way, please give it a like.

[kathyOne]

Thanks Devvj, "I'm fairly sure you can't tie a Service Principle to the SharePoint connector." Thanks for your answer... How do we set up the Canvas app to SharePoint online connection as Microsoft recommends best practice? We currently use a service account that has a username and password Office 365 account. The reason our organization security did not approve our approach is that the service account has a username and password which means it can be shareable, even we explained that this service account is for SharePoint Online data connection, and actually the Canvas app will run as the users' permissions on SharePoint online. So any other alternative we can use so far? For our case, migrated a customized .net sandbox 2013 SharePoint  Online application to SharePoint online? thanks for all of your help.. 

[Devvj]

There is a way to run stuff through the "HTTP Request"-connector in Power Automate and run API-calls from there directly against SP Online as a Service principal, but I do understand that's a really longshot way of doing it.

[kathyOne]

Thanks for your quick response and suggestion.  Here is the Canvas app connection to SharePoint lists.. it is better from the Canvas app.  The reason we chose the Canvas app is for low code implementation, if that much complicated, it looks like we need to switch to SPFx applications. thanks Why did Microsoft recommend the Service principal account but did not make it possible for Canvas app connection to SharePoint online connection to use a service principle account. 

[kathyOne]

Thanks Devvj. After more research, it looks like the standard SharePoint connection in Power Platform required a username and password kind of account to set up a connection. You are right, and thank you for your response to this.  

So I am thinking can we build a customized connection by using a identity account to SharePoint online as connector? wondering if it is the correct path. I saw many posts for customized connections but most of them are for API, Wondering if anyone has similar experience to build a customized connection to connect to SharePoint online site with service identity account (no interactive account). thanks