Power Platform Community Forum Thread Details

Hi all,

I’m working on a Model-Driven App (Dynamics/Power Apps) integration where we want to show an external web application inside the Power Apps mobile app shell (without opening an external browser).

However, based on Microsoft documentation, we are seeing several constraints:

MSAL redirects are not supported inside iframes
https://learn.microsoft.com/en-us/entra/msal/javascript/browser/iframe-usage
Authentication inside an iframe isn’t supported in mobile clients
https://learn.microsoft.com/en-us/power-apps/maker/model-driven-apps/iframe-properties-legacy
Iframes behind authentication boundaries are not supported
https://learn.microsoft.com/en-us/power-apps/developer/model-driven-apps/web-resources

Given these documented limitations, we are trying to understand what supported or practical approaches others are using in real-world implementations.

Goal

From a record (e.g., Account/Lead), open an external web app inside the Power Apps mobile shell
Pass record context securely (record id, entity name)
Avoid session hijack / replay if a launch token leaks
Avoid opening an external browser if possible

Current technical idea (server-driven launch pattern)

User clicks a command/button in the model-driven app
We call a Dataverse Custom API server-side (identity derived from InitiatingUserId, not from client inputs)
The Custom API generates a short-lived, one-time launch token (TTL 1–5 minutes)
Mobile loads the external app inside an embedded frame (web resource / PCF hosting iframe)
Optional hardening: client-generated nonce (“bindingId”) to reduce replay risk

The external app would exchange the launch token server-side and establish a secure session.

Questions for the community

Given the documented limitations, is there any supported pattern to securely embed an authenticated external web app inside the Power Apps mobile shell?
In practice, are people:
- Moving the UI into a Custom Page or PCF, keeping only the backend external?
- Using a backend-for-frontend (BFF) style pattern?
- Using token-per-request approaches instead of cookies?
- Or ultimately opening the external app in the device browser as the only stable option?
Does it make any difference (from a mobile support or security standpoint) whether we use:
- A web resource iframe, or
- A PCF control hosting an iframe?
If staying inside the shell is mandatory, what architecture have you successfully implemented that aligns with Microsoft’s supported scenarios?