Power Platform Community Forum Thread Details

Hi all,

I've had a look around and have seen similar questions to the below but mostly regarding SharePoint as a data source whereas this will be Dataverse. Also, the vast majority of the posts are not marked as Solved, so I'm hoping someone can advise.

Scenario:

A model driven app, with Dataverse hosted data.
User A with credentials within the host tenant: standard: Power Apps Premium licence.
User B without host tenant credentials, but with a Microsoft account as an employee at an institution with a Microsoft tenancy.

Question:

Can the model driven app (and the underlying data) be shared with user B?

Proposed solution:

As proposed in Matthew Devaney’s blog article (albeit that references SharePoint as the data source);

Add the Guest User to the host tenant, within an Entra group (“Group B”).
Licence any member of Group B to inherit a Power Apps Premium Licence.
Assign the appropriate security roles and share the model driven App with Group B.

Does this work, or is another approach required (and if so please could you share details)?

Many thanks for your help!

Categories:

Building Power Apps

1. Guest User Access to Dataverse

Guest users in Microsoft Entra ID (formerly Azure AD) can be granted access to Power Apps and Dataverse, but Dataverse permissions for external users are limited.
Unlike SharePoint, Dataverse does not natively support guest access without additional configuration.

2. Power Apps Licensing for Guests

Each guest user must have a Power Apps Premium license (either assigned in the host tenant or via their home tenant with a per-app/per-user plan).
Simply assigning a license to an Entra group does not automatically grant guest users a license in Dataverse. The Power Apps per-app/per-user license must be explicitly assigned.

3. Security & Sharing the Model-Driven App

Adding the guest user to an Entra group ("Group B") is good practice for security role management.
Ensure that the guest user has appropriate security roles in Dataverse (at least Read access to the necessary tables).
Guest users might face issues with Model-Driven Apps because their security roles don’t always apply correctly. You might need to assign permissions directly instead of relying solely on the Entra group.

4. Recommended Approach

Invite User B as a Guest to the Host Tenant using Microsoft Entra ID.
Assign Power Apps Premium licensing to the guest user in one of these ways:
- A per-user Power Apps license assigned to them directly.
- A per-app Power Apps license covering the specific Model-Driven App.
Assign Dataverse Security Roles:
- Ensure they have appropriate security roles (custom role if needed) that grant table access.
- Test access with minimal privileges first to avoid excessive permissions.
Share the Model-Driven App with Group B.
Have User B log in using their guest credentials at make.powerapps.com and test their access.

Alternative Option: Power Pages

If the goal is external user access, consider Power Pages instead of a Model-Driven App. Power Pages is designed for external users without requiring full Dataverse access.