Answered

Security Issue?: Cannot log out of PowerApps

(0) Share

Report

Posted on by Community Power Pla... Microsoft Employee

I have reproduced with multiple browsers (Edge, IE, Chrome) using multiple tenants with multiple accounts (Global Admins, Service Admins, PowerApps user).

Steps to reproduce:

(let's pretend we have two tenants named ContosoA & ContosoB)

Go to https://web.powerapps.com
Log in with credentials for ContosoA
Go to upper-right user icon and click to open the drop down
Click on "Sign Out"
Wait for the sign out process to complete
Close all browser windows (including those not being used for PowerApps)
Open browser again and go to https://web.powerapps.com

After Step #7 there is no prompt to login. I am taken directly to my PowerApps workspace and allowed all the same access even though I formally signed-out and closed all browsers. There is no prompt to reauthenticate.

To continue, I found this works in both directions (which is the really scary part for developers)
Repeat steps 3-6
Open browser and go to https://ContosoB.sharepoint.com
Verify you are logged in with correct accout for ContosoB as expected (so far, so good)
Click the waffle in the upper-left corner and selec the app PowerApps
Wait the new tab containing the PowerApps workspace to load
Look at the upper-right corner and see the account currently logged in for PowerApps
Is it for ContosoB (as it should be) or is it for ContosoA?

For me, it's the latter. This doesn't happen using InPrivate browsing, so that's at least something. The bigger issue is, since I manually signed-out, it should at least be prompting me to sign in again. But that is not happening.

Categories:

Building Power Apps

I have the same question (0)

All responses (4)

Answers (1)

Sort by

v-monli-msft Microsoft Employee on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @localneeds2018,

This is mainly because that you have chosen to remember the login and password when you login to PowerApps site for the first time. I sometimes also encounter this issue, I usually get around this by going to https://powerapps.microsoft.com/en-us/ and select GET STARTED FREE:

Then go step by step, where you could login with the new account.

Regards,

Mona

Was this reply helpful? Yes No
Community Power Pla... Microsoft Employee on at

Like
a
(1)

Report
Copy link

Link copied!

That doesn't address the very serious problem: Clicking 'Sign Out' and closing the browser does not actually sign you out. The 'Sign Out' function, by definition, should work regardless of whether I chose to remember my login when I first authenticated. This is especially bad since I can be logged into one tenant, click the 'PowerApps' icon there, and be auto-directed to a different tenant with no additional login prompt at all. Frankly, that's terrifying and sort of a show-stopper from a application security standpoint.

Was this reply helpful? Yes No
Verified answer

Community Power Pla... Microsoft Employee on at

Like
a
(1)

Report
Copy link

Link copied!

I had a similar problem. I have two O365 Enterprise profiles (one for my work, one for a client's), and I couldn't get out of the client's profile. I use Chrome. Clearing cookies that have powerapps (there are half a dozen or so websites with powerapps name on it) allowed me to finally switch back to my work's environment.

Was this reply helpful? Yes No
Community Power Pla... Microsoft Employee on at

Like
a
(2)

Report
Copy link

Link copied!

After reading this thread, I wouldn't consider this as 'Solved'. While I realize this was years ago, I am seeing this same behavior now. Did you ever get a resolution for this?

Was this reply helpful? Yes No