Unanswered

Sharing documents via Power Apps without Microsoft login.

(0) Share

Report

Posted on by Derek1121

Hello,

My company has a Power App that we use to make documents accessible in Teams. The problem is that employees must sign into their Microsoft account when they click a document to view or print. It is a little inconvenient, and I would like to find a way to remove the login credential requirement.

The documents are individually linked to Power App buttons OnSelect using the Launch () function.

The PDF documents are located in a SharePoint library in folders. The SharePoint library settings are set to public for anyone with a company email. I've shared the library, shared the folders, and tested sharing individual documents, but it still requires login credentials every time. This issue persists if I link the document from OneDrive and share it.

Are there any better ways to share documents where employees will not be required to sign in every time?

Thanks,

Categories:

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (4)

Answers (0)

Sort by

cchannon 4,702 Moderator on at

Like (0)

Report
Copy link

Link copied!

Yes. The OAuth2 Implicit Grant flow allow you to send authentication hints as part of the URL which can reduce the frequency of unnecessary login prompts. These hints allow you to pre-seed a login with the domain name and username (among other things) which can push users right through if the prompt would otherwise pop up even though they have an active token.

all you need to do is seed your URL with the additional query string parameter login_hint (although also including domain_hint wouldn't hurt).

Here's a couple links to pages that should get you started:

Microsoft identity platform and OAuth 2.0 implicit grant flow - Microsoft identity platform | Microsoft Learn

Azure AD and Microsoft Office365 Deep Links and Sign In URLs - darrenjrobinson - Bespoke Identity and Access Management Solutions

(yes, it really is as simple as just adding "&login_hint={email address}" to the URL)

Note: This is not guaranteed to eliminate all extra login prompts, but it should significantly reduce the number of them to the point where they are only coming up when the user browser session really does not have a valid token.

Was this reply helpful? Yes No
Derek1121 4 on at

Like (0)

Report
Copy link

Link copied!

@cc I am new to this, so I apologize if I'm not making sense. I'm also unsure what information below would be inappropriate to share, so I redacted unique information.

I registered my power app in Azure Entra ID, attempted to set permissions, and tried multiple variations of url seeds. I've added below my interpretation of the url seed required based on the link you provided above. I've broken lines for readability.

Do you have any ideas about where I went wrong?

{URL leading to my SharePoint document}
/Organization/oauth2/v2.0/authorize?
client_id={Azure Entra Id generated client id}
&response_type=id_token
&redirext_uri={redirect uri URL-encoded}
&scope=openid
&nonce={I'm really not sure what to put here}
&domain_hint={company domain}

Thanks

Was this reply helpful? Yes No
cchannon 4,702 Moderator on at

Like (0)

Report
Copy link

Link copied!

I would just try to simplify things and just hint the user and domain. That should be all you need to do:

{URL leading to my SharePoint document}
/Organization/oauth2/v2.0/authorize?
~~client_id={Azure Entra Id generated client id}~~
~~&response_type=id_token~~
~~&redirext_uri={redirect uri URL-encoded}~~
~~&scope=openid~~
~~&nonce={I'm really not sure what to put here}~~
&domain_hint={company domain}

&login_hint={user email}

Was this reply helpful? Yes No
Derek1121 4 on at

Like (0)

Report
Copy link

Link copied!

Hello,

I am still having trouble with this. I have tried various combinations including changing the token, adding different variations of the other parameters. Most combinations give me an url error ERR_INVALID_RESPONSE. The only time I do not get this error is when I add the following url seed exactly as shown below (plus or minus the domain_hint, client_id, redirect_uri, and scope).

/Organization/oauth2/v2.0/authorize?
&domain_hint={company domain}
&login_hint={user email}

Of course, when I submit the above url, I get the login screen that literally enters {user email} as the email, but it is the only time I am able to get redirected to login to microsoft with the email "auto-generated". I tried logging into that screen so get an incorrect password.

I've also tried hardcoding my email into the login_hint which lead me to the ERR_INVALID_RESPONSE error screen.
Lastly, I've tried adding the login_hint dynamically using Text(User().Email) in a hidden label to reference. This attempt still brings me to the ERR_INVALID_RESPONSE error screen but does show the dynamic function being read properly.

I am not sure where to go from here. Any other advice would be greatly appreciated.

Thanks.

Was this reply helpful? Yes No