users can view app but do not consume a per-app license

[jojam]

Hello

I'm trying to determine why certain users can successfully run a Power App (with a premium connector).

We have a shared Dev Power Platform environment (type=prod), to which I assigned 1 per-app license for testing purposes. I shared the app with 4 different users, and they can all access the app. I was expecting errors since there is only 1 license.

Licenses and Roles assigned

User 1:
Roles: DevOps Admin, Power Platform admin, Global reader
Licenses: D365 BC Team Member, D365 Team Member E5, Power Automate Free, Power BI Free

User 2:
roles: none
no licenses ("unlicensed" in M365 Admin)

User 3:
roles: none
licenses: D365 BC Essentials, D365 Cust Service and Sales, E5, Power Automate free, Power BI Free, Teams Exploratory

User 4:
roles: none
licenses: none ("unlicensed" in M365 Admin)

I could understand User 1 and 3 having access, but why can #2 and #4 see it? Should unlicensed users not get "you cannot access this app" or something like that?

Note: our tenant has not yet been onboarded to the License Preview experience in the Power Platform Admin Center, which would partially answer my question. MS support wasn't terribly helpful.

thanks in advance for any insight!

[thomasfnorthrup]

Hello, thanks for reaching out. 

The purpose of the per app license is that the users do not need any licensing. Did user 2 and 4 access at exactly the same time? That is when they should get an error. Let me know if this helps by marking as a solution or giving some kudos. 
Have a great day!

[joe_hannes_col]

Hello @thomasfnorthrup,

My understanding is that Per App licensing does not license the app itself. It is also user-based in the sense that every user that wants to use the app and is not licensed otherwise will need a Per App license (or app pass).

@jojam, sorry that doesn't answer your question though - I would expect either users 2 or 4 to receive an error message stating they are not adequately licensed.

[thomasfnorthrup]

Hello, @joe_hannes_col is correct, sorry for the misinformation. I checked the licensing guide and with per app licensing the license needs assigned to the user and to the app. 

[jojam]

Yes my thoughts as well.  My understanding is that the licenses are technically consumed when you share the app even if the App Pass is checked when they launch the app.  Makes sense in a way, since otherwise the system would have to verify licenses real time at the time of sharing.  So it isn't a "pool" that gets released back - that is what PAYG is for. 

I thought that maybe the D365 licenses and admin roles (like Sys Admin / Power Platform Admin) were kind of special cases and let you run the app without explicit license - but that doesn't explain the unlicensed users. Anyway just trying to "do the right thing" and be properly licensed. 🙂  

Support guy was friendly and tried to be helpful, but he kept telling me "it's not my area". LOL  Ah well. 

[joe_hannes_col]

Well, the D365 licenses give you access to (some) premium features of the Power Platform, which explains why users 1 and 3 can access certain apps.

Technically, if you want to be on the safe side, you should consider this information from the Power Platform licensing guide for your application, even for your users with Dynamics 365 licenses:

As of today, these Dynamics 365 licenses include Power Apps capabilities:

So if your app is outside the context of your D365 apps and is using a premium connector, you would need premium licenses, e.g. PAYG or Per app passes for your users. How this is enforced is obviously another matter 😉

And I guess it would be pretty easy for Microsoft to check and enforce capacities if they enabled "real" per app licensing (not on a per user per app basis) - but since we don't have this licensing option this is a pretty academic discussion 🙂

[jojam]

Thanks for the reply and information.  I have concerns about this very thing - very good point about the context of the app. This app does indeed have nothing to do with D365, so I don't know how to ensure we are licensed except to buy per-app licenses and not assign them to the environment - or alternatively make sure to share the app to 1 or 2 less people than your total licenses.  Talk about clunky, I'm hoping this is smoothed out soon.  The PAYG won't be helpful in this case since it is via Billing Policies and you cannot have a PAYG billing policy and also have per-app licenses.

Actually maybe this is a question I can put to support - about ensuring we are covered when we have D365 licenses.  

Anyway thanks again for the input. 

[joe_hannes_col]

Yes, I agree that managing Per App licenses is not very user-friendly.

Out of curiosity: why would you buy per app licenses and not assign them to the environment?

My understanding is that to be compliant in this case, all users that use your app will need standalone premium licenses, e.g. per user, per app, or (not in your case) PAYG. One way of ensuring compliance hence would be to assign a quantity of per app licenses to your environment equal to the total number of app users.

Anyway, if you raise this with Microsoft support and get an answer out of this, please share.