web
You’re offline. This is a read only version of the page.
close
Skip to main content

Announcements

Welcome to the Power Platform Communities
News and Announcements icon
Community site session details

Community site session details

Session Id :
Power Platform Community / Forums / Power Apps / Allow external user to...
Power Apps
Unanswered

Allow external user to run canvas app

(0) ShareShare
ReportReport
Posted on by WebPortal 2,297

Hello,

 

My solution contains one canvas apps and multiple power automate flows (both instant and scheduled).

Now, I've shared the app with one external user, which has been added to our Azure AD as a guest.

The data source is dataverse and the licensing model is an Azure pay-as-you-go subscription linked to the environment.

When the user logs in, she sees the following connection request:

 

WebPortal_0-1712767710169.png

 

Although:

  1. all the connection references in this environment are using my connection (including OneDrive for Business)
  2. all the instant flows have me as the run-only user

So, she can't run the app at all.

How to overcome this?

Thank you in advance!

Categories:
Building Power Apps
  • Philip1279 Profile Picture
    Philip1279 19 on at

    Curious - If data is in dataverse why is it trying to connect to Onedrive? - which unless you have given access to the guest - yes it will fail.

  • Robu1 Profile Picture
    Robu1 1,722 Super User 2026 Season 2 on at

    Hello @WebPortal ,

    It seems like you’re facing an issue with sharing your app and allowing an external user (added as a guest in Azure AD) to run it. Let’s address this step by step:

    1. Connection References:

      • You mentioned that all connection references in the environment are using your connection. This is a good practice, but let’s verify that the connections are correctly set up.
      • Ensure that the connections (such as Dataverse and OneDrive for Business) are shared with the external user. You can do this by navigating to the Connections section in your Power Apps environment and checking the permissions for each connection.

    2. Instant Flows:

      • Instant flows run under the context of the user who triggers them. Since your instant flows have you as the run-only user, the external user won’t be able to execute them.
      • To allow the external user to run instant flows, consider the following options:
        • Shared Connection: If the instant flows require connections (e.g., sending emails, updating records), ensure that these connections are shared with the external user.
        • Delegated Flows: Consider using delegated flows (Power Automate flows triggered by Power Apps) instead of instant flows. Delegated flows run with the user’s permissions and can be shared with guests.

    3. App Permissions:

      • Check the permissions assigned to the app itself. Make sure that the external user has the necessary permissions to run the app.
      • Go to the App Settings and review the permissions under Permissions for this app. Adjust them as needed.

    4. Environment Permissions:

      • Verify that the external user has appropriate permissions at the environment level. They should have at least the Run Flows permission.
      • Navigate to the Environment Settings and check the permissions for the guest user.

    5. Testing and Troubleshooting:

      • Test the app with the external user’s account. Pay attention to any error messages or issues encountered during app execution.
      • Review the Power Automate runs history to identify any specific errors related to permissions.

    6. Documentation and Training:

      • Provide clear instructions to the external user on how to access and use the app. Document the necessary steps, including connection setup.
      • Consider creating a training guide or video to assist the user.

    Remember that Azure AD guest users have limitations, especially when it comes to running flows and accessing resources. Ensure that the necessary permissions are granted, and troubleshoot any issues systematically.

    Feel free to provide additional details or ask further questions if needed!

     

    If this post helps, then Click on the Thumbs Up below and Accept it as the solution to help others.
     
    Thanks,
     
    Robu1.
  • WebPortal Profile Picture
    WebPortal 2,297 on at

    Hello @Philip1279 

    It is because one of the flows is getting one file from my OneDrive and processing it.

  • Philip1279 Profile Picture
    Philip1279 19 on at

    And does the Guest user have access to this file ?
    Also read Robu1 answer as she covers it in more depth (maybe too much if you do not have PP Admin rights), but certainly a few things to check.
    Not all developers have access to the PP Admin portal to change ENVs settings!

  • WebPortal Profile Picture
    WebPortal 2,297 on at

    Not direct access to the file. It is a word template that is filled in and uploaded to dataverse, for the user to download.

  • Philip1279 Profile Picture
    Philip1279 19 on at

    try giving them specific access to that file.
    Lets try things 1 by 1, then try again.
    The normal practice for this is you (your team) have a guest access user for testing these things and activate/de-activate as needed, before rolling out to externals

  • WebPortal Profile Picture
    WebPortal 2,297 on at

    @Robu1 

    Thank you for your detailed answer.

    I'm the PP Admin, and am now trying to check your proposed solutions.

     

    The user is being asked to provide authentication for OneDrive for Business and for Office 365 Outlook, although there are other services, like SharePoint and Word Online within the solution, but no Sign in is required (there's only a "Show warnings" label.

     

    So, following your recommendation to share the connections, I see an error message "user@email.com isn't in your organization's directory".

     

    I'm now going to investigate about "Delegated flows" which are new to me.

     

     

  • WebPortal Profile Picture
    WebPortal 2,297 on at

    @Philip1279 

    Thanks, that sounds like a good idea.

     

    After signing in OneDrive for Business with the same credentials, I get the error:

    WebPortal_0-1712777625978.png

     

     

    The request failed with client error: 'Input parameters are invalid. See details for more information. Details:OAuth2CertificateOneDriveForBusiness Authorization Flow failed for service OneDrive For Business Certificate. MSGraph drive endpoint failed. StatusCode=400 (BadRequest), Response=
{"error":{"code":"BadRequest","message":"Tenant does not have a SPO license.",

     

     

    So it seems the issue is related with the license?

    Although this solution is linked to a pay-as-you-go billing associated with the environment.

     

    And after signing in Office 365 Outlook, I get the error:

    WebPortal_0-1712777837890.png

     

    REST API is not yet supported for this mailbox. This error can occur for sandbox (test) accounts or for accounts that are on a dedicated (on-premise) mail server.

     

  • Philip1279 Profile Picture
    Philip1279 19 on at

    It is stating an SPO license which is Sharepoint Online, so it is not part of their Guest account, not a PP license issue, but their actual MS license.  This is where having your own guest account would be useful for testing.
    Compare the guest account subscription to your one and then see the difference

  • WebPortal Profile Picture
    WebPortal 2,297 on at

    @Philip1279 

    The external account is in another domain, and is one I can control.

    It has no licenses associated, but as mentioned, this is a pay-as-you-go environment.

    I can create another test account with a Power Apps single license, but it will probably have the same issue.

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

News and Announcements

Welcome to the Power Platform Communities

Quick Links

Season of Sharing Community Challenge Winners!

Congratulations to our community stars!

Kudos to our 2025 Community Spotlight Honorees

Expanding mentorship, skilling, and AI innovation

Congratulations to the August Top 10 Community Leaders!

These are the community rock stars!

Leaderboard > Power Apps

#1
11manish Profile Picture

11manish 397 Super User 2026 Season 2

#2
Mohsin Ali Profile Picture

Mohsin Ali 354

#3
WarrenBelz Profile Picture

WarrenBelz 232 Most Valuable Professional

Last 30 days Overall leaderboard

Featured topics

Auto-Populate field Power Pages
Gallery Tabs - Show or Hide Tabs based on Field Value
How to patch multiple records at once
Enable Copilot for end users in model-driven apps
Question for everyone : How are you using Create Text GPT in AI Builder?
Community content - sample components, blogs etc. - Link to this page (http://aka.ms/PCFdemos)
Welcome to the Power Apps forum!

Product updates

Microsoft Power Platform Community release plans