Cloud Decoded

By default when you deploy any PowerApps application which uses connections to various data sources like SharePoint, Azure AD etc, it would show a popup to all the users trying to access the application and ask for their consent to be able to connect to the backend data sources on their behalf.

In general, from security point of view, this might still be acceptable to some organizations. Since also, this appears to be a one time consent granted by end users.

But is it? Everytime, you make any update in the PowerApps application related to those data sources, the consent popup will reappear and users will have to grant to consent again.

This can get annoying easily, as in the cloud world we live today, evergreen applications are the norm.

So, what can be done about that?

Suppress the Consent Popup

Yes, you got it right. As the title of this article suggests, let’s do some quick magic and suppress this message for all users for the selected application(s).

If you do a google search about this issue, you would quickly find out that there is a simple command available to achieve this – Set-AdminPowerAppApisToBypassConsent. Then why this article at all?

Well, this is to ensure you get it right first time. Since I have seen many IT Administrators struggling to run this command when the developers request this during their PowerApps application rollout.

Permission Requirement

• Office 365 Global admins or Azure Active Directory Global admin permission
• These administrators need to sign in to the PowerApps Admin Center at least once before using the PowerShell cmdlets.
• A PowerApp License should be assigned to this admin account

Office 365 Global admins or Azure Active Directory Global admins no longer require a P2 license for administrative access to the PowerApps admin PowerShell cmdlets.

So, in a nutshell, in most production environments, you might need to ask one of the Office 365 Administrator to run this command for your application(s).

Pre-requisites

We need to install the required PowerShell modules before the actual command can be executed. First, let’s get the PowerApps Administration module installed.

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell

This command may give a nice little warning message about “untrusted repository”. Just go ahead and type “Y” and enter.

Now, we need to install PowerApps PowerShell module

Install-Module -Name Microsoft.PowerApps.PowerShell -AllowClobber

Ensure to add the -AllowClobber switch otherwise you might receive an error message similar to this –

Now that both the modules are installed, let’s move to next step.

Find Application ID

If you are a PowerApps developer reading this article, you might already know this, but I will add here just in case you are new to PowerApps.

• Go to web.powerapps.com and click on Apps in left navigation
• Click on “…” next to the App of which you need to find the ID
• Click on Details from the context menu

You will see the App ID mentioned at the bottom of the new screen. Copy and note it down to share with the Office 365 Administrator.

Now, we have almost everything ready to go ahead and try to suppress the consent popup for all users.

Create Connection to PowerApps

Essentially, at this stage we just need an one line script

Add-PowerAppsAccount

I prefer this one, because this opens up a login screen which can accept users with Multi-factor Authentication (MFA) enabled. Since, for most all organizations, MFA is enabled for their Office 365 Admin accounts, this works like a charm.

If in your organization, that’s not the case, then you can also pass the admin credentials directly in the script

$pass = ConvertTo-SecureString "password" -AsPlainText -Force
Add-PowerAppsAccount -Username [email protected] -Password $pass

Once the connection is successfully established, you are ready to run the Suppress command.

Set-AdminPowerAppApisToBypassConsent

The actual command is one liner

Set-AdminPowerAppApisToBypassConsent -AppName <AppID>

But when the Office 365 Administrator executes it, he/she might get this error message

So, what happened?

Well, even though the error message is a bit cryptic about the PowerApp Path, essentially, the Office 365 Administrator doesn’t have permission on your application.

Just go to your app again from web.powerapps.com and share it.

Add your Office 365 Administrator as Co-Owner of the application.

This access is required only to run this command. After the command gets executed successfully, permission can be removed.

Run the script again and Whola… A nice success message appears and all your application users are happy not being prompted again by incremental changes done in the application going forward.

Hope this helps save some of your efforts. You can refer this microsoft article for more details about other PowerApps Administration related commandlets.

Enjoy,
Anupam