#PowerPlatformTip 76: 'PowerApps Sharing with Guests'

TL;DR: Invite guests into the team, make the team’s Microsoft 365 group security enabled (once, with Update-MgGroup), then share the canvas app with that group. Members and guests get the app and the team’s SharePoint site through the same membership. Guests need a licence that matches the app.

💡 Challenge

You built a canvas app on a SharePoint list for a project with external partners. Sharing the app, the list and the site with every guest one by one is slow, and when people join or leave the project, three places have to be updated.

✅ Solution

Use the Microsoft 365 group behind the team as the single access list. Guests are added to the team, the team’s SharePoint site already grants the group access, and the app is shared with the same group. Power Apps can share apps with Microsoft 365 groups only if the group is security enabled, which you switch on once.

🔧 How It’s Done

1. Add the guests to the team.

🔸 In Teams, add the external users as guests of the team. If they are new to your tenant, Microsoft Entra creates a B2B guest account for them. B2B external collaboration must be allowed in your tenant.

2. Store the app data in the team’s SharePoint site.

🔸 Create the list in the SharePoint site that belongs to the team. Members of the group, guests included, already have access through the site permissions.

3. Enable security on the Microsoft 365 group.

🔸 Microsoft 365 groups created outside Microsoft Entra ID, for example by creating a team, have SecurityEnabled set to false, so Power Apps can’t find them in the sharing panel. As owner of the group, run:

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "Group.ReadWrite.All"
Update-MgGroup -GroupId "<group object ID>" -BodyParameter @{ SecurityEnabled = $true }
Get-MgGroup -GroupId "<group object ID>" | Select-Object DisplayName, SecurityEnabled

🔸 The same change via Graph REST is PATCH https://graph.microsoft.com/v1.0/groups/{group-id} with {"securityEnabled": true} and the permission Group.ReadWrite.All. Setting it does not change how Teams or other Microsoft 365 features work.

4. Share the app with the group.

🔸 After a few minutes the group appears in the app’s Share panel. Share it with permission User.

5. Send the guests the app link.

🔸 Guests open the app in a separate browser session (another browser or InPrivate), so Power Apps uses their guest identity in your tenant. In Power Apps Mobile they switch to your directory.

🎉 Result

One membership controls everything: add a guest to the team and they get the app and the data, remove them and both are gone.

🌟 Key Advantages

🔸 One access list: team membership grants the app and the SharePoint data.

🔸 Less admin work: no per-user sharing of app, list and site.

🔸 Clean offboarding: removing a guest from the team removes app and data access together.

⚠️ Good to Know

🔸 Licences: a canvas app with standard connectors (such as SharePoint) needs Power Apps included with Office or a Power Apps plan for the guest, assigned in the guest’s home tenant or in yours. Apps with premium connectors or Dataverse need a Power Apps per user or per app plan. Per app plans are bound to an environment and are not recognised across tenants.

🔸 Graph permissions: guests have limited rights in Microsoft Graph, so connectors such as Office 365 Users can return less data for them.

🔸 Dataverse for Teams environments are deprecated. Build new guest apps on SharePoint or in a regular Dataverse environment instead.

🎥 Video Tutorial

🛠️ FAQ

1. Can I share a canvas app with guests without a group?

Yes. You can share with each guest account individually. A group makes adding and removing people easier, because app, site and list follow the same membership.

2. Why can’t I find my team’s group in the share panel?

Its SecurityEnabled property is false. Enable it as shown in step 3 and wait a few minutes.

3. Does the guest have to accept the invitation first?

No. If the guest opens the app before accepting the invitation, they are asked to accept it while signing in.

🔗 Related Tips

🔸 #PowerPlatformTip 87: ‘Licensing & Sharing Canvas Apps with Guests’ - the licensing side of guest access in detail.

🔸 #PowerPlatformTip 48: ‘Sharing of Flows and Power Apps’ - the general sharing options for apps and flows.