Unanswered

Power Platform Build Tools Canvas App Owner - cannot share app

(0) Share

Report

Posted on by jzia93

Hi,

We recently migrated our deployment pipeline into Azure DevOps using the Power Platform build tools, running into an issue with regards to canvas app ownership:

We migrate the solution from dev to test as expected, all components work just fine, except I cannot, as the system admin, access the Canvas App.

Looks like all components of the solution are 'owned' by the application user in the environment (the one connected to the service principle in Azure DevOps.)

This includes the canvas app, such that in the imported Power Apps solutions I can see:

Canvas App: MyAppName

Owner: ApplicationUser

Problem is, as the system admin for the environment, I can't access the Canvas app, as it has not been shared with me.

With the application user being a service account, I also don't know how to share the canvas app.

My workaround has been to remap ownership of the application using Power Automate. I migrate ownership from Application User -> System Admin for that environment, and then share the app in the normal way.

However, this isn't something I'd like users doing every time we have to import an upgraded solution.

Moreover, I'm unsure how changing the owner affects importing newer versions of the solution. I definitely don't want users to have to run a flow everytime a solution is imported, just to be able to access the canvas app.

Hopefully I'm missing something and would really appreciate some clarity here.

Thank you

Categories:

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (20)

Answers (1)

Verified answer

EricRegnier 8,720 Most Valuable Professional on at

Like (1)

Report

Hi @jzia93,
I believe that's a current limitation. What I've done is have an additional Azure DevOps task that sets the right owner and permissions after the package or solution has been successfully deployed in the target environment. You can have a PowerShell task or even a invoking a Power Automate flow via a http request task.
PowerShell cmdlets: https://docs.microsoft.com/en-us/power-platform/admin/powerapps-powershell
Set App Owner: https://docs.microsoft.com/en-us/connectors/powerappsforadmins/#set-app-owner
Hope this helps...

Was this reply helpful? Yes No
jzia93 40 on at

Like (0)

Report
@EricRegnierthank you for the swift response - much appreciated!

Two followups, if you don't mind:

For deploying/updating across tenants (ISV model with continued updates), does changing the owner affect whether the service principal can continue to apply updates to the app?
Also across tenants, is there a way to set the new owner email at runtime - on a per tenant basis? Specifically:
Client A, tenant = Contoso, environment = contoso.crm4.dynamics.com, admin user primary email = john@contoso.com
Client B, tenant = Acme Parts, environment = acmeparts.crm5.dynamics.com, admin user primary email = jane@acmeparts.com
Ideally, we would want to configure A, B such that separate owning users are set for each tenant/client (using flow/powershell)
Thank you

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (0)

Report
As long as SPN account has the right access to the target environment, it should be fine. What do you mean by across tenants? If different O365 tenants then you’ll need different pipelines for each because as far as I know, an Azure DevOPs service connection is only bound to one O365 tenant
Not sure I understand your scenario. Seems like you have CDS environments by the URL so you don’t need to change the email. These admin account with their emails are configured in O365 and if they have D365 Service Admin or Power Platform Admin role in D365 than they will have admin on all environments. If not you can assign System Administrator role to their respective environment

Was this reply helpful? Yes No
jzia93 40 on at

Like (0)

Report
Thank you for clarifying point 1 @EricRegnier , again, much appreciated 😊

RE: point 2 - we manage deployments of the same solution to multiple clients, so our CI/CD pipeline aims to keep a consistently updated version for all customers of the same solution (as per this MSFT Ignite Video)
In my example, Contoso is one client and Acme Products is another.
Each client (Contoso, Acme) has a service principle in DevOps setup so we can patch solution updates to them, as a separate import stage in a single Azure pipeline.
Each tenant is a separate O365 tenant and company- so the admin is a different user.
RE part 2: The admin user will be a known individual but will vary between clients (jane vs. john).

Based on what you've said, my plan at the moment will be something like:
Create variables for each client in DevOps with the admin primary email $(AdminEmail<ClientName>)
For each new deployment, either run a flow or PowerShell script in the client environment to migrate the app owner to the admin, building this into onboarding.
Will see how far we get with this approach.

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (0)

Report

Thanks for clarifying point 2, makes sense. I would actually have a Variable Groups per client, so each client settings is self contained in their own group. Then I would tag the proper variable group per stage (i.e client). Let me know how that goes. Cheers

Was this reply helpful? Yes No
jzia93 40 on at

Like (0)

Report

Thanks Eric, I hadn't been using groups until now, I think that's a perfect way to keep everything organised.

Will mark your first response as a solution for the time being, as it clarified my initial question.

Much obliged!

Was this reply helpful? Yes No
PowerChewie 8 on at

Like (0)

Report

@EricRegnier Could you expand on how to perform this directly on Azure DevOps? Everything I have seen online requires you to first find the AppID in order to perform the change, which would defeat the purpose of automating the process using the pipeline.

Was this reply helpful? Yes No
PowerChewie 8 on at

Like (0)

Report

An option is presented in the following video but is not an automated solution 1:25 in the video below.

DevOps for Power Platform - YouTube

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (0)

Report

Hi @PowerChewie, what part exactly would you like me to elaborate? Cheers!

Was this reply helpful? Yes No
PowerChewie 8 on at

Like (0)

Report

Hi @EricRegnier, I can't find a way to implement a script directly into the Azure DevOps pipeline to do the change in ownership as you suggested. Do you have an example on how that can be done directly in the pipeline? Thanks!

Was this reply helpful? Yes No