Understanding Permissions Model - Power Apps with SharePoint

[audrieg]

I would like help understanding the permissions model. I am assuming that sharing an app, is very much like sharing a document. The very act of sharing a document, gives the recipient of the share access to it. However, since we can often integrate connections/flows that query and update more than 1 datasource, I'm confused on how to manage sharing so that my users are not seeing blank controls. Would you please help me...

Which one of these is true?

A. When I configure a connection to a SharePoint site using my credentials for a data source, then the app will always use my permissions to access the data. (I assume if I leave the company the access will be denied, so maybe we'll want to set up an account where the password doesn't expire specifically for power apps?)

B. Even though I configured my connection to a SharePoint site using my credentials, the app will still use the consumer/end-user permissions to access the data while they are running the app.

C. I have the option to configure connections through my own account, or to make it dynamic (which will always leverage the users credentials).

D. End Users of Power Apps will need to have a Power App license in Office 365, even if they just use (but do not create) apps.

Also, if you can point me to any documentation on permissions/authentication requirements (especially for sharing apps), I would appreciate it.

Thank you so much! I'm really enjoying this app a lot!

Audrie

P.S. The problem I am trying to solve for is that I shared an app with a user connected to SharePoint (where they have contributor access for the whole site, and where the 4 lists that are being used by the app are inheriting permissions). However, when using the app, they could not see the list items in the browsing gallery, and when they tried to add a new item, form submit resulted in a red message "an error occurred on the server". On the other hand, when I use the app (I am the global admin), it works as expected. I don't want to elevate her permissions higher than what is needed, hence my question above.

[sarafankit · Accepted solution]

Hi Audrie,

'B' is true for SharePoint Online connections. Some connection types are shareable, but SharPoint Online requires each user to bring their own connection. Here are some details on sharing of resources: https://powerapps.microsoft.com/en-us/tutorials/share-app-resources/

The article I linked above and https://powerapps.microsoft.com/en-us/tutorials/share-app/ are two articles on sharing currently. Please let us know if the information you are looking for is missing in documentation.

Regards

[audrieg]

Thank you for that information. I'm stumped though because this user actually is a member on the site with contributor access. So they can read and write to the same lists that I can. What do you think might be missing in that scenario that would return a blank gallery to them?

Thank you again,

Audrie

[sarafankit · Accepted solution]

Can you try to share the app with another user who has access to the same list and check if they see the blank list as well? Another thing I will try is to remove & re-create the SharePoint connection for the user.

I am also actually surprised to hear that this is happening, can you or the user please open a support ticket: https://aka.ms/pasupport. We may need to get some logs to help understand the issue.

[audrieg]

I only have one beta tester available, but I could try and create a fake user and simulate that way.

FYI: She can open the list and edit it from SharePoint directly.

Ok, I'll open a support ticket.

Thank you!

Audrie

[audrieg]

1 more thing on this point: If I am building the apps for a customer, do I have to build them in their tenant? Is there a way to build them in my tenant and migrate them to the customer's tenant after it's been q&a'd?

I'm thinking that if I have access to the SharePoint sites in their tenant then I can create connections to them, without actually having to be in their tenant while building the apps.Do you agree?

Also, I don't see anything in that article about licensing.....does each 'user' comsuming the apps need to have a PowerApps license, or only those who are building them?

Audrie

[sarafankit · Accepted solution]

After building the app in your tenant, you can save the app locally to your computer which would generate a .msapp file. This .msapp file can then be opened in the customer's tenant and saved to cloud in their tenant.

[audrieg]

Thank you so very much!

Do you know the answer to the second question above? Will consumers of the app need the Power Apps License?

Thank you again!

Audrie

[sarafankit]

Audrie: We currently dont have any details/updates on the licensing model, we will share them once they are finalized.

Regards,

[audrieg]

I understand your answer. The problem we'll have as partners is in the planning phase.....we want to help the customer plan requirements (whether they simply be configuration requirements, or cost requirements). I'm ok with not have the cost defined yet, but it's going to be hard to plan if I don't know if the license is required or not (even while it's free).

Make sense?

For now, I'll try setting up beta-testers with and without licenses to see how it works today.