Unanswered

PowerApps "per App" User gets Access to all Instances

(0) Share

Report

Posted on by Thomas Fialek

Hi there!

we have an application behavior we cannot really understand when assigning the PowerApps per App license. We assigned a test-user only the "PowerApps per App base" license and found that access to all three instances of the Tenant is possible. Although we assigned the "App Pass" only to the test-instance. If we assign the CRM system administrators to the test user, the user even has unlimited access to all applications including customizing. The behavior with the CRM Administrator role is the same in all three instances.

We have assumed that the user only gets access to the instance that has been assigned the "App Pass" and a maximum of 2 applications.

Have you already made some experience here? Is this behavior normal?

Attached pictures as proof that we made everything accordingly to Microsoft Docs 🙂

Categories:

Governance & administering

I have the same question (0)

All responses (4)

Answers (0)

Sort by

a-ovbord Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Hi @Tomeczek,

As far as I see from the screen shots, those look like Model Driven apps.

Model Driven app sharing is different than the Canvas App sharing.

Here is the documentation for sharing a Model Driven app: https://docs.microsoft.com/en-us/powerapps/maker/model-driven-apps/share-model-driven-app#share-your-app-for-basic-use

To restrict user access, please remove the security role for the user. Generally it's Common Data Service User but you might have a custom security role for the app, if you created one.

Hope this helps.

Thank you,

Ovidiu

Was this reply helpful? Yes No
Thomas Fialek 27 on at

Like (0)

Report
Copy link

Link copied!

I know how to restrict access to a model driven app. My initial question is how the user as access to all three instances? I thought he should only get access to the test-instance, where the app pass is assigned.

Is this really by desgin that the user has access to all three instances and can see all apps, when the user has the PowerApps per App and administrator role?

Can you ensure us that this is by design?

Was this reply helpful? Yes No
a-ovbord Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Hi @Tomeczek,

Is this app present in all the environments or just in the test one?

Thank you,

Ovidiu

Was this reply helpful? Yes No
Thomas Fialek 27 on at

Like (0)

Report
Copy link

Link copied!

Yes, the same apps are present in all three instances.

- Dev
- Test
- Prod

I still don't really understand why am I explicitly assigning an "App Pass" to the test environment (please see pictures), if the app is visible and accessible on all three instances? Could you please explain to me the technical background? Don't link me to a Microsoft Doc article because I was already reading everything regarding this topic and I don't understand it.

Was this reply helpful? Yes No