Fabric licensing question for Power Apps and Power BI

[tfmeier_oz]

I'm very new to Power Platform and related licensing.

I build a Power Apps app and when starting I requested a trial Fabric license. I'm now at the end of this trial and I'm unsure as to what to do. In addition I have shared the Power Apps app with a test user and he gets a Graph API accessDenied error. The app triggers an underlying flow to pull data from a few tables on SharePoint via the Excel connector.

I need to be licensed to build Power Apps apps as well as Power BI reports. Can I get an overall license to address these requirements or do I need to get licensed separately. Is there an overview/license matrix to get my head around this?

[tfmeier_oz]

I have further info on this. The issue is with the flow which pulls data from the connected tables via the Excel connector

List_rows_present_in_a_table_2 uses the Excel connector to which I have authenticated with my account. Question: When another user triggers this flow through the app (as evidenced above), the Excel connector - being connected via my account - should still work? Or does the user have to be a member of the SharePoint site and have access to the Excel file the flow references? If so this kind of defeats the purpose as these backend connections should be shielded from the user. I would expect the user to only have access to the Power Apps app and any backend operations to be handlde by the respective connections.

For instance what if there is information in the file we don't want the user to see? If they have access to the SharePoint site and Excel file they'll be able to open this file

[v-prasare]

Hi @tfmeier_oz ,
Hope your doing well.

The Excel connector in your Power Automate Flow is authenticated using your credentials (as the app creator), but when another user triggers the flow via the Power Apps app, it may still validate the user's permissions for the referenced SharePoint site and Excel file.

By default:

• Even though your connection is being used to retrieve data in the flow, the SharePoint permissions on the Excel file can restrict the user's ability to trigger this connection indirectly.

If the triggering user does not have access to the Excel file or SharePoint site, this can result in the accessDenied error.

Instead, please refer to below alternatives:

1. Use "Run-Only Users" in Power Automate: Go to your Flow in Power Automate, Click on the Edit button. Navigate to the "Run-Only Users" section. Choose the connection for the Excel connector and set it to "Use this connection (always use the creator's credentials)".

Advantage: The flow will always use your credentials, and users triggering the flow won’t need permissions on the Excel file or SharePoint site. This shields users from seeing or accessing the backend data.

2. Use Service Accounts for Connections: Instead of connecting flows to your personal account, create a dedicated service account with access to SharePoint and the Excel file.
   Update the Excel connector in Power Automate to use the service account. Ensure the service account has sufficient permissions for backend operations.

Advantage: Separation of user permissions from backend operations. Adds a layer of security and avoids personal account reliance.

3. Adjust SharePoint Permissions: If you need to continue using Excel in SharePoint. Add the test user to the SharePoint site or provide restricted file access.

For instance, create a SharePoint role with read-only permissions on the Excel file. Ensure they can trigger the flow but restrict what they can do on the site.

Drawback: Users may still technically have access to the Excel file, which might expose sensitive data.

4. Consider replacing the Excel file with Dataverse or SQL Server to improve security and access control. you'd like further guidance on setting up Dataverse, let me know!

Thanks,

Prashanth Are

MS Fabric community support.

Did I answer your question? Mark my post as a solution, this will help others!

If my response(s) assisted you in any way, don't forget to drop me a "Kudos" 

[tfmeier_oz]

Re item 1 which looks like the most elegant solution for us; i.e.

1. Use "Run-Only Users" in Power Automate: Go to your Flow in Power Automate, Click on the Edit button. Navigate to the "Run-Only Users" section. Choose the connection for the Excel connector and set it to "Use this connection (always use the creator's credentials)".

Do I need to also add these other users to the "run-only" permissions on top of that panel. I have changed the setting to "use this connection..." but the user gets the same error.

[v-prasare]

@tfmeier_oz, Thanks for actively participating in MS Fabric community support.

Yes, in addition to setting the flow to "Use this connection (always use the creator's credentials)," you also need to provide the other users "Run-Only" rights.
How to fix it: 

In Power Automate, open your flow.
1. navigate to the Run-only users area.
2. to the list of Run-Only Users, add the test user (or any other user).
3. make sure the flow is set up to "Use this connection" for the Excel connector under the connection options.

This combination guarantees: Your excel connector credentials are used by the flow.
through the Run-Only Users setup, the other users are specifically authorized to start the flow.
this should fix the 'accessDenied' problem once it is configured.

Thanks,

Prashanth Are

MS Fabric community support.

Did I answer your question? Mark my post as a solution, this will help others!

If my response(s) assisted you in any way, don't forget to drop me a "Kudos" 

[tfmeier_oz]

Thank you. What about the flow itself? When adding a user I saw this note

The authorisation for the Excel connector should be addressed through your earlier advise. What about the logic flow? I couldn't find any areas other than making a user an owner of the flow which is obviously not what we want. How do I provide access to the user so they can run the flow?

[v-prasare]

@tfmeier_oz ,please find below documentation for reference. let me know if this helps.
Manage owners and users in your Microsoft list flows with Power Automate | Microsoft Learn

additionally, refer to this: Microsoft Power Platform Community Forum Thread

Thanks,

Prashanth Are

MS Fabric community support.

Did I answer your question? Mark my post as a solution, this will help others!

If my response(s) assisted you in any way, don't forget to drop me a "Kudos" 

[v-prasare]

Hi @tfmeier_oz ,

Thanks for reaching out MS Fabric community support.

The Graph API accessdenaid in your Power Apps app points to an authorization issue where the app or flow does not have sufficient permissions to access the required data. Here's a detailed approach to address both the licensing issue and the error:

To resolve this, you’ll need to check two main areas:

• Azure AD Permissions:

Go to the Azure Portal and open App Registrations. This is where your app registers to access Microsoft services like SharePoint or Excel. Add permissions such as Files.Read for Excel access or Sites.Read.All for SharePoint. Once the permissions are added, grant Admin Consent to confirm the app can access the data.

• User Access:
  Ensure the test user has proper permissions to the SharePoint site or Excel file. Check SharePoint and confirm the user has at least read access to the list or file. Without this access, the user will continue to face the error.
• Reconnecting the Data Source:
  Go to Power Apps or Power Automate and check the connection to SharePoint or Excel. Sometimes, it uses an outdated account. Re-authenticate by logging in with an account that has the correct permissions.

You need licensing to build Power Apps apps and Power BI reports. Unfortunately, there is no single license that directly covers both, but you can combine licenses as follows:

Requirement	License	Cost
Build and Share Power Apps with Premium Features	Power Apps Per User Plan	$20/user/month
Build, Share, and Collaborate in Power BI	Power BI Pro	$10/user/month
Trigger Premium Flows (Power Automate)	Included in Power Apps Per User	-
Access Microsoft 365 Services (SharePoint, Excel)	Microsoft 365 Business/Enterprise	Varies (from $12/mo)

Recommendations:

• For You (as the app and report creator): Power Apps Per User Plan (to build apps with premium connectors). Power BI Pro (to create and share Power BI reports).
• For Test Users: Power Apps Per App Plan ($5/user/app/month) for app access. Ensure users have a Microsoft 365 license for SharePoint and Excel.

Conclusion:

1. First, fix the access issue by updating the app permissions in Azure AD and verifying user access to SharePoint or Excel.
2. Reconnect the connectors in Power Apps or Power Automate using an account with the right permissions.
3. Get the right licenses for yourself and your users so everyone can use the app and you can continue building reports and apps without limitations.

Thanks,

Prashanth Are

MS Fabric community support.

Did I answer your question? Mark my post as a solution, this will help others!

If my response(s) assisted you in any way, don't forget to drop me a "Kudos" 

[tfmeier_oz]

Thank you for the quick response. I will check the authorisation in Azure AD.

Re the licensing to recap:

• Power Apps: $20/user/month to create and share apps (myself) and $5/user/month for the user to use
• Power BI Pro: $10/user/month to create and share reports; what licensing does the user require to view Power BI reports shared by myself?