Unanswered

Service Principal setup

(1) Share

Report

Posted on by cxiong

Hello,

Does anyone know how to setup a Service Principal to access PowerApps in devops pipeline through connection service? Do we have to assign the Service Principal certain permissions?

Thank you

Categories:

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (13)

Answers (0)

EricRegnier 8,720 Most Valuable Professional on at

Like (1)

Report
Hi @cxiong,
Assuming this SPN requires access to Power Apps CDS, you can follow these steps:
Create the object in Azure AD: https://docs.microsoft.com/en-us/powerapps/developer/common-data-service/walkthrough-register-app-azure-active-directory
Create the user in CDS and assign a security role: https://docs.microsoft.com/en-us/power-platform/admin/create-users-assign-online-security-roles#create-an-application-user
You'll than need to create a generic service connection in Azure DevOps and use that connection with Power Apps Build Tools
Hope this helps!

Was this reply helpful? Yes No
Ryan S Newcomb 236 on at

Like (0)

Report

What do you use for the generic connection if you are setting it up as service principal? Do you only need to enter the app registration Secret in the Password/Token field?

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (0)

Report

I also had to create that user in Office 365 (no license assigned) and made sure that the CDS application user's username (service principal) was the same as in O365. I then use the O365 username and password in the generic service connection since unfortunately as of now, it doesn't seem to work with client ID and secret...

Was this reply helpful? Yes No
Ryan S Newcomb 236 on at

Like (0)

Report

So you set it up as non-interactive user rather than as an application user?

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (0)

Report

It’s setup as both

Was this reply helpful? Yes No
Ryan S Newcomb 236 on at

Like (0)

Report

Today I noticed a new Service Principal option on the Export Solution task in the pipeline editor. (Perhaps it was there before but I didn’t notice it.) I was able to use that option to a setup what appears to be a new service connection type specific to the Power Apps Build Tools (Before, I was using Generic service connection). I set that up and it worked just fine.

That new connection type option was also available for Import Solution tasks.

I didn’t notice it for the environment tasks (eg reset).

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (2)

Report

Hi @NewcombR, @cxiong,
You can now connect with a SPN (app ID, secret) with the new Power Platform service connection type! Make sure the URL is CDS/D365 organisation URL (<name>.crm<#>.dynamics.com) and not the usual "https://management.core.windows.net/".
I'm now using it and works like a charm!

Was this reply helpful? Yes No
NPrice99 1,302 on at

Like (0)

Report

Hi @EricRegnier

Are you saying I can use ClientID and Secret for both PowerApps and PowerAutomate authentication ?

Where is this documented ?

Thanks

Nigel

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (0)

Report

@NigelP, not quite, what I was mentioning was for Service Connections in Azure DevOps. I know in Logic Apps, you can use a client ID and secret with the Common Data Service connector but I haven't tried with canvas apps. As for Power Automate, suggest to use the Common Data Service (current environment) connector which I don't think can be used with a client ID/secret yet.
You should submit the idea at: https://powerusers.microsoft.com/t5/Power-Apps-Ideas/idb-p/PowerAppsIdeas
Cheers

Was this reply helpful? Yes No
Community Power Pla... on at

Like (0)

Report

@EricRegnier ,
- What CDS security role is needed for Azure DevOps to export/import a Solution?
- Does the Service Principal need any specific permissions/roles?

Was this reply helpful? Yes No