App Source Canvas App - how to prevent customers seeing code and functionality

(1) Share

Report

Posted on by Josh@ACT

We are a small ISV and have published a PowerPlatform solution with a canvas app. While we published as a managed solution, etc. we are seeing that our customers can edit the app and see all the code and functionality we've built. Our 2025 plan includes ramping up several new App Source offerings with Canvas Apps included, but we won't be doing that if we can't protect our efforts and someone can easily replicate.

Any help or guidance is greatly appreciated!

After a customer purchased this solution, this is what they can see when selecting "App" - clearly you can see they can edit it and did confirm they can go in an navigate through the app in the editor and see al the code, etc.

This is the solution view - it is working as expected by preventing the editing.

This is the offer. Business Apps – Microsoft AppSource

Categories:

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (10)

Answers (0)

Suggested answer

kasraouiah 305 on at

Like (0)

Report
Copy link

Link copied!

Hello i think it's possible to do so by exporting solution as managed solution as a matter of fact it will not be editable i think and users can't see coded stuff

Was this reply helpful? Yes No
Josh@ACT 9 on at

Like (0)

Report
Copy link

Link copied!

I appreciate the quick response @kasraouiah. I thought the same > that the managed solution would lock it down (which our solution is managed), but that is why we are so surprised that our hard work is editable. Big concern for us! Welcome any thoughts on how to lock down further!

Was this reply helpful? Yes No
WarrenBelz 154,791 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hi @Josh_TheInnovator,

This is an issue that has been regularly raised on this community over the years and is probably getting more relevant as the sophistication of apps grow. Unfortunately whether packaged in a Solution (unmanaged or managed) or simply developed / exported to the environment, someone (at least one person) in the tenant needs to be the owner of the app and therefore have edit rights. Also anyone with Admin rights can reset passwords and Global Admins can override a lot of settings.

One result of all of this allows recovery of an app if the owner left the company and their account was cancelled - this seems to be more important than any IP issues . . .

Please click Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider giving it a Like.
MVP (Business Applications) Visit my blog Practical Power Apps LinkedIn

Was this reply helpful? Yes No
Suggested answer

VeGETzX 367 on at

Like (1)

Report
Copy link

Link copied!

Hi @Josh_TheInnovator

Before export the solution, You can click on Advanced > Managed properties, and then turned off the 'Allow customization' option.

By doing this, after the solution was imported as managed solution to target environment, no one can edit it (even the user who are the owner of the app or admin, no way to edit)

This can prevent your app for being edited BUT it doesn't protect the source code because the person who have solution zip file (both unmanage and managed) can extract it and then unpack your app using Power Platform CLI, They will get all of the source code in YAML file.

I can say that it will need 'more effort' to replicate your app, but it still possible anyway.

Was this reply helpful? Yes No
WarrenBelz 154,791 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

@VeGETzX,

That surprises me a bit as this question has been raised many times in the past. If what you are saying is true, then if the person who supplies the app is no longer available for any reason, then you can never recover or further update the app ? This is particularly relevant if an MS update breaks something and it needs fixing.

Was this reply helpful? Yes No
Josh@ACT 9 on at

Like (0)

Report
Copy link

Link copied!

@WarrenBelz> Don't think being able to lock an app down for editing when published to App Source has anything to do with an app owner. Agreed all apps must have owners, but doesn't require them to have edit access.

If you are having issues with changing owners when someone leaves though, easy enough to swap over. Here is an article that captures all of the ways to change ownership across all the power platform solutions.

How to Change Solution Owner in the Power Platform - DEV Community

Was this reply helpful? Yes No
Josh@ACT 9 on at

Like (0)

Report
Copy link

Link copied!

Thanks @VeGETzX . We'll give that a shot. In the meantime, have you used this as well? Not even sure if it works on Power Apps or not (yet anyways), but sounded like it can achieve a similar purpose.

https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/developer/devenv-security-settings-and-ip-protection

Was this reply helpful? Yes No
WarrenBelz 154,791 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hi @Josh_TheInnovator,

That is something I have never seen posted before (the last step on customisations) - and I am always happy to learn something new for future responses to this issue. However it is not completely fool-proof if the customer has the Solution Zip file. If you extract the msapp from the zip and then use Import app > From package (zip), it opens the app in Edit mode.

My previous comment was not about ownership as such (I know how to change owners), but about the fact that if the original creator of the app/solution was not available to fix an issue, the app is effectively dead.

Was this reply helpful? Yes No
Josh@ACT 9 on at

Like (0)

Report
Copy link

Link copied!

Thanks @WarrenBelz. Out of curiosity, have you been able to access or download the solution zip file when getting a solution from appsource?

Was this reply helpful? Yes No
WarrenBelz 154,791 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hi @Josh_TheInnovator,

It does not seem to leave a zip file anywhere I can find.

Was this reply helpful? Yes No