End user receives pop-up asking for permission when launching PowerApps
I’m a big fan of working with PowerApps and creating business solutions using that tool. Until last week I wasn’t aware, that when I use specific permissions to access data sources (SharePoint in that case) inside my app, the end user who is going to use that app will be asked for permissions, to be able to use that application.
The message users were seeing was as following:
This situation is usually a “no go” from business owners, who are asking “why is this showing” and claiming, that when a regular, end user sees it, he is not going to click anything because of the confusion. Well, they are right.
I was looking the internet for some of the solutions, information, how to impersonate such connection or elevate permissions for it, so that user is not asked to grant them on his own. I found, that there is an idea already submitted: https://powerusers.microsoft.com/t5/PowerApps-Ideas/Delegate-to-Administrator-Allow-access-window-when-sharing/idi-p/98739 about allowing to make connections on behalf of a specific account. Cool, but that’s an idea only.
Then I found this topic: https://powerusers.microsoft.com/t5/General-Discussion/End-Users-receive-pop-up-asking-for-permission-when-launching/td-p/31906/ and the solution described using PowerShell Cmdlets for PowerApps (described here: https://docs.microsoft.com/en-us/powerapps/administrator/powerapps-powershell).
I tried them, and it works! Below a step by step, so that you can get rid of these popups forever.
PowerApps cmdlets installation
Important! You have to have administration account on your machine and be a Global Administrator of your Office 365 tenant, to follow the installation and execution steps!Source: https://powerapps.microsoft.com/en-us/blog/gdpr-admin-powershell-cmdlets/
- Download the PowerShell Scripts file.
- Unzip the file into a folder.
- Open Windows PowerShell as an administrator.
- Set the location path of your PowerShell console to the folder, where you unzipped the scripts (using the “cd” command).
You need now to elevate/ change Execution Policy level of the scripts on your machine. Type the below in PowerShell window:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
Next, as the Microsoft team is saying, that there is a known issue today that may also require to manually unblock the PowerShell, copy and paste the following command:
dir . | Unblock-File
Next, import necessary modules:
Import-Module .\Microsoft.PowerApps.Administration.PowerShell.psm1 -Force
Import-Module .\Microsoft.PowerApps.PowerShell.psm1 -Force
PowerApps cmdlets execution
This call will open a prompt to collect the credentials (AAD account & password) that will be used by the commands. Provide your Global Admin credentials. It is going to be valid for the next 8 hours:
Next open the details page of the PowerApps app you would like to “enhance” and copy its App ID:
Be sure, that the Global Admin account, if different to yours, also has “Co-owner” access to the app or is the “Owner” (and has PowerApps P2 license assigned). In case not, share the app with that account:
Now copy, replace “APP-ID” with yours and execute the following Cmdlet, to bypass requesting for permissions:
Set-AdminPowerAppApisToBypassConsent -AppName APP-ID -ApiVersion 2017-05-01
If all went fine, you should now see the “Code: 200” and “Description: OK”. Starting now, when your end users are going to open the app, they will not see that prompt for permissions again.
Disclaimer: before executing the Cmdlet I have republished the app using the Global Admin account. Haven’t checked if all would work without that. Nevertheless, once the Cmdlet was run, I have been developing the app with my regular account, published it several times and the prompt is not showing up anymore.
I’m not seeing where to download the powershell scripts. The link may have been changed or the content since this blog was posted. Could you elaborate or update your notes? Thank you!!!
Hey, I tried to open every URL from the post. Every single one works fine. Which is not working for you?
Does simply importing the modules as described here: https://docs.microsoft.com/en-us/power-platform/admin/powerapps-powershell#installation not working for you?
Thank you for the articles.
I had a question regarding the permissions.
Do these commnads give the logged in user elevated permissions on the data sources being used by the powerapp?
e.g., if the powerapp has a sharepoint connection and performs both read and write operation. If the logged in user only has read permission on sharepoint, will this powershell allow for elevated permissions to write to the sharepoint list as well?
No, they don’t give elevated permissions. They just make that this message to consciously allow app to use connection on user’s behalf is not shown and this approval is done by default.
To read about elevated permissions try this post: Elevated permissions in Microsoft Flow.
Would this work for ‘Dynamics 365 Finance & Operation’ connector as well.
Hi, this should work for any connectors used by Power App.
I am using Outlook connector in power apps to send mails by logged i user.How to revoke other permissions such as create,delete permissions e.tc. for the end users which are not necessary
You can’t. End-user has full permissions to their mailbox. So does connection created on their behalf.
Hi, I would like to know, for example the when I connected my powerapp to outloook 365, it asks for permission to use my email to read, delete, update and send emails, but I just want outlook to have permission to send email and disable the delete update and read emails, is it possible to control the permissions at granular level using these methods ? If yes, do you know any blog or tutorial where I can find them. Thanks
No, it’s not. Because it is asking user to grant permission on their behalf. But it doesn’t matter. As long as your app is not performing delete actions, then despite the fact user grants those permissions, app won’t delete anything.
Correct me if I’m wrong , from what I can understand by reading this is that this solution is for when the powerapp is a standalone app and not when it is a customized form from a sharepoint list.
If so, does the solution still apply for a customized form?
Another issue that my end users face is the permission popup window disappears before they can react to it. The popup appears when they want to view the sharepoint item.
Any help with the above mentioned issue would be helpful.
Thanks and Regards
Hi, that PowerShell cmdlet should work both for standalone and for SharePoint customized form. Each app has its own guid, that you need to pass as the parameter.
Regarding the other issue, I truly don’t know how to help. First of all, it should appear once, but be visible, as long as user clicks confirmation.
I wanted to try the steps mentioned for suppressing the permission popup for the custom form but I can’t find the APP ID for it.
Please help me in this.
Thanks for the reply Tomasz.
I will need to arrange all the requirements for the Powershell cmdlet and will try after I have them.
I was able to figure out the other issue and solved it. The reason behind that issue – I was trying to navigate to a particular screen after loading the forms , this order made it so that the popup got hidden/disappeared because the command to navigate to screen was running right after the popup appears.
My O365 tenant admin ran the cmdlets command after he published the app from his account and the popup was not appearing for the users.
But after some days the popup reappeared for the users.
What could be the reason behind the reappearance of this popup
1. Because I published the app from different account than the one which ran the commands?
2. Refreshing the data connections in the app?
3. MFA of our tenant?
Any ideas why this happened and how to avoid this?
I would say this is related to significant changes in your app, so change of data connection/ source may have triggered it. Or maybe someone used cmdlet to Clear-AdminPowerAppApisToBypassConsent.
Excellent write-up! A few quick questions…
a. On the step that says to download the PowerShell Scripts from the URL (https://docs.microsoft.com/en-us/power-platform/admin/powerapps-powershell#installation), where is the package to download? I believe a previous person asked about it but I still can’t find the spot to download it 🙂
b. Can this be done on a SPOnline Management Shell to?
Hi, thank you!
So first you need to start PowerShell console as instructed under the shared link. SPOOnline Shell should work too. Nevertheless once started simply follow the described steps, so type Install-Module and console should get the modules automatically.
Hey Tomasz thanks fot the post,
We followed all the instructions and we get the 200 response.
But the Power BI consent still popping up every time we open the app.
Any other solution?
Honestly not. It should remove all prompts for consent. Maybe Power Bi is above it. Hard to say.
I have 10 data sources in my Canvas App. Out of the 10, I cannot povide SharePoint list permission to the app-users to a data source/list, due to security reasons.
Is there a way I can create an elevated connection targeting this one data source alone? Instead of elevating the entire app. Any solutions?
Yeah, possibly somehow using Power Automate and child flows. So that this specific scenario is handled by Flow, not directly via Power Apps.
I deployed this script on my environment and SP/CDS/O365 connectors dissapeared from the list but my custom connector I made for integration is still visible and everyone sees also Approvals connector which is default MS connector. Is there a way to make it dissapear as well?
Hi, this is because only first party connectors are affected by that feature: https://docs.microsoft.com/en-us/powershell/module/microsoft.powerapps.administration.powershell/set-adminpowerappapistobypassconsent?view=pa-ps-latest#description
I published a PowerApp that uses SharePoint, Outlook, Office 365 user and Approval connections. After running the script successfully, it removed all the prompts except for Approvals? Do you know why? Have you encountered such an issue?
Hard to say. Approvals look like a first party connector so it should work as per description here: https://docs.microsoft.com/en-us/powershell/module/microsoft.powerapps.administration.powershell/set-adminpowerappapistobypassconsent?view=pa-ps-latest#description. Have you tried contacting MS Support?
Thanks for the simple yet helpful article. Once the PowerShell script is run, Can the global admin stop being a co-owner of the app or stop having access to the data (say, SharePoint list for instance).
Global admin can be removed as a co-owner from the app. This must be done by the app’s owner. However, speaking about the data, that is more complex, as global admin can literally have access anywhere 🙂
Thanks for the article, it proved very helpful. I don’t have a GA account on the tenant where I was trying this out, but am a PowerApps Admin and I can confirm that I was able to successfully set the property on a number of Apps. When tested the new user did not receive the prompts which had previously been seen, so this appears to be successfully applying the required change to the App config without having a Global Admin account.
I should also add that if this is attempted with an account with the PowerApps Admin role which is not licensed for PowerApps, then the operation will fail with a 403 Forbidden error message
Thanks for letting others to know 😉