Sharing documents via Power Apps without Microsoft login.

[Derek1121]

Hello,

My company has a Power App that we use to make documents accessible in Teams. The problem is that employees must sign into their Microsoft account when they click a document to view or print. It is a little inconvenient, and I would like to find a way to remove the login credential requirement.

The documents are individually linked to Power App buttons OnSelect using the Launch () function. 

The PDF documents are located in a SharePoint library in folders. The SharePoint library settings are set to public for anyone with a company email. I've shared the library, shared the folders, and tested sharing individual documents, but it still requires login credentials every time. This issue persists if I link the document from OneDrive and share it.

Are there any better ways to share documents where employees will not be required to sign in every time?

Thanks,

[cchannon]

Yes. The OAuth2 Implicit Grant flow allow you to send authentication hints as part of the URL which can reduce the frequency of unnecessary login prompts. These hints allow you to pre-seed a login with the domain name and username (among other things) which can push users right through if the prompt would otherwise pop up even though they have an active token.

all you need to do is seed your URL with the additional query string parameter login_hint (although also including domain_hint wouldn't hurt).

Here's a couple links to pages that should get you started:

Microsoft identity platform and OAuth 2.0 implicit grant flow - Microsoft identity platform | Micros...

Azure AD and Microsoft Office365 Deep Links and Sign In URLs - darrenjrobinson - Bespoke Identity an...

(yes, it really is as simple as just adding "&login_hint={email address}" to the URL)

Note: This is not guaranteed to eliminate all extra login prompts, but it should significantly reduce the number of them to the point where they are only coming up when the user browser session really does not have a valid token.

[Derek1121]

@cc I am new to this, so I apologize if I'm not making sense. I'm also unsure what information below would be inappropriate to share, so I redacted unique information. 

I registered my power app in Azure Entra ID, attempted to set permissions, and tried multiple variations of url seeds. I've added below my interpretation of the url seed required based on the link you provided above. I've broken lines for readability. 

Do you have any ideas about where I went wrong?

{URL leading to my SharePoint document}
/Organization/oauth2/v2.0/authorize?
client_id={Azure Entra Id generated client id}
&response_type=id_token
&redirext_uri={redirect uri URL-encoded}
&scope=openid
&nonce={I'm really not sure what to put here}
&domain_hint={company domain}

Thanks

[cchannon]

I would just try to simplify things and just hint the user and domain. That should be all you need to do:

{URL leading to my SharePoint document}
/Organization/oauth2/v2.0/authorize?
client_id={Azure Entra Id generated client id}
&response_type=id_token
&redirext_uri={redirect uri URL-encoded}
&scope=openid
&nonce={I'm really not sure what to put here}
&domain_hint={company domain}

&login_hint={user email}

[Derek1121]

Hello, 

I am still having trouble with this. I have tried various combinations including changing the token, adding different variations of the other parameters. Most combinations give me an url error ERR_INVALID_RESPONSE. The only time I do not get this error is when I add the following url seed exactly as shown below (plus or minus the domain_hint, client_id, redirect_uri, and scope).

/Organization/oauth2/v2.0/authorize?
&domain_hint={company domain}

&login_hint={user email}

Of course, when I submit the above url, I get the login screen that literally enters {user email} as the email, but it is the only time I am able to get redirected to login to microsoft with the email "auto-generated". I tried logging into that screen so get an incorrect password. 

I've also tried hardcoding my email into the login_hint which lead me to the ERR_INVALID_RESPONSE error screen. 
Lastly, I've tried adding the login_hint dynamically using Text(User().Email) in a hidden label to reference. This attempt still brings me to the ERR_INVALID_RESPONSE error screen but does show the dynamic function being read properly. 

I am not sure where to go from here. Any other advice would be greatly appreciated. 

Thanks.