Org vs. Workspace Apps - permissions & embedding

Hi pghMR​,

Both of those look like current limitations of org apps rather than a setting you are missing (they are still evolving, so worth re-checking the docs' limitations list before rollout). Two practical workarounds so you can still pick org apps:

1. "Entire organization" -> an all-employees group. Create a dynamic Entra ID group that always contains every active employee, and use it as the audience. Membership updates automatically for joiners and leavers:

Entra ID > Groups > New group
  Group type: Security
  Membership type: Dynamic User
  Rule:
    (user.accountEnabled -eq true) -and (user.userType -eq "Member")

(Dynamic groups need Entra ID P1. If you don't have it, many orgs already have an "All staff" group maintained by HR/IT that you can reuse.)

2. SharePoint -> embed the reports, link to the app. Rather than embedding the app, embed the key report pages with the Power BI web part (or "Embed report > SharePoint Online" link) and add a "Open full app" button that links to the org app. Permissions still flow from the app audience / workspace access, so users only see what they are allowed to.

SharePoint page
  -> Power BI web part: Report A (page "Overview")
  -> Power BI web part: Report B (page "Summary")
  -> Button: "Open the full Sales app" -> org app link

So my overall approach would be:

Org app as the main distribution channel
-> Audience = dynamic "all employees" group
-> SharePoint = embedded report pages + link to the app
-> Re-check org app limitations as they reach GA

AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.