By 
In this “Share Model Driven App in Power Apps” tutorial, we will learn how to share a model-driven app with external users or guest users and how to share a model-driven app with internal users in Power Platform step by step.
Sharing a Model-driven app with both internal and guest users in Power Platform is an essential task for organizations looking to collaborate efficiently. While the overall process is straightforward, it differs significantly from sharing Canvas apps due to the dependencies on Dataverse and security roles.
In my previous article, I have shown how to share Canvas apps with external or guest users, but the way of sharing Model-Driven apps is a little different than the Canvas app sharing. Model-Driven apps need extra attention while sharing with other users than the Canvas apps. In this demo, I will explain everything in detail.
In this article, we’ll explore the steps required to share a Model-driven app with both internal and external users, discuss its similarities and differences with sharing Canvas apps, and provide a comprehensive guide for users. Let’s dive in!
How to Share Model Driven App with External and Internal Users in Power Platform
Before we start the demo on how to share a model-driven app with external and internal users, let us understand what a model-driven app is in the Power Platform.
Understanding Model-Driven Apps
Model-driven apps are built on Dataverse and rely on the underlying data model and relationships. They come with pre-built layouts and components, focusing on data-driven experiences. Sharing a Model-driven app involves managing user access, licenses, and Dataverse security roles.
Read Also: How to Create Model-Driven App in Power Apps: Step-by-Step Guide
Steps to Share a Model-Driven App
1. Add Guest or Internal Users
- Guest Users:
To share with external users, add them as guest users in Azure Active Directory (Azure AD).- Navigate to Azure AD > Users > New Guest User.
- Enter the guest’s email address, customize the invitation message, and send the invitation.
- Then, add the guest user to security group or Microsoft 365 group (this is not mandatory but recommended).
- Internal Users:
Internal users are automatically part of your Azure AD tenant, so no additional steps are required to add them.
Read my previous article for the detailed steps on how to create guest users and internal users in Azure AD: Create Guest Users: How to Create and Manage Guest Users in Azure AD
2. Assign Appropriate Licenses – how to assign license to Guest Users in Microsoft 365
- For guest users, assign a Power Apps license (e.g., Power Apps Per App Plan or Power Apps Per User Plan) from the Microsoft 365 Admin Center.
- For internal users, ensure they have a license that matches the app’s requirements (e.g., premium features or Dataverse).
Detailed Navigation to Licences: Login to Microsoft 365 admin center -> Click on the Licenses, from the Billing section -> Then, select your license or subscription.
Then, select the Users or Groups tab. Click on the “Assign Licenses” button, then select Enter your external user’s Gmail ID or other email ID, then select the apps or services you need for your guest users.
Note:
- Search for users in your organization by name or email address to assign them licenses for Microsoft 365 E5 Developer (without Windows and Audio Conferencing). You can assign to a maximum of 20 users at a time.
The below screenshot for how to assign licenses to users:
The below screenshot for how to assign licenses to Security Groups:
Assign licenses to groups in Microsoft 365 Admin center
Notes:
- Search for groups to assign Microsoft 365 E5 Developer (without Windows and Audio Conferencing) licenses to. You can assign to a maximum of 20 groups at a time.
- Here, we can assign licenses only to security-type groups, not Microsoft 365 groups.
- For Power Apps, you must select “Power Apps for Office 365 (Plan 3),” at least as of today.
3. Assign Dataverse Security Roles – how to assign security roles to External Users
Assigning security roles is the extra step while dealing with the model-driven app in Power Apps compared to the Canvas App, as the model-driven app is driven by the Dataverse backend table.
Model-driven apps use Dataverse security roles to define user access to tables, records, and app features.
- Go to the Power Platform Admin Center.
- Navigate to Environments > [Your Environment] > Settings > Security > Security Roles.
- Assign a relevant role (e.g., Basic User, Custom Role) to the user or guest. Ensure that the role includes access to tables required by the app.
Assigning the security roles in Power Platform to guest users, external users, or internal users is not straightforward. First, you need to create a team in the Power Platform environment, then add security roles to that team, and then add members to the team.
By the way, there are four types of teams in Power Platform. The below screenshot shows the “Microsoft Entra ID Security Group” type team, where I have configured my Azure AD security group, and it also shows how we can add members to the team.
For the detailed description and steps, refer to my previous article on Teams in Power Platform: Teams in Power Platform: How to Create a Team in Power Platform Admin Center?
For the detailed description and steps, refer to my previous article on security roles in Power Platform: How to assign security roles to users in Power Platform
For this demo, I have created a team with the type “Microsoft Entra ID Security Group Type Team,” where I have configured and mapped my “External or Guest Users Collaboration” security group.
Microsoft Entra ID Security Group Type Team in Power PlatformIn next step, see the magic. 🙂
4. Share the App: How to share model driven app with external users or security group.
Once users have been added and assigned roles, you can share the app:
- Go to the Power Apps Maker Portal.
- Select the Model-driven app.
- Click Share and enter the email addresses of internal or guest users or enter the security group or Microsoft 365 group.
- Assign the required security role for each user.
Detailed steps are given below:
Below is my sample demo model driven app.
Share Model Driven app in Power AppsSelect your model driven app, click on the “Share” option as shown above.
Add people and assign security roles so that they can use your app.
Enter your security group or Microsoft 365 group name and select security role (roles); your group corresponding team will be picked automatically.
By the way, you can directly select your user by name and email ID as well.
Click on the “Share” button.
We can the app sharing status message “Sharing model driven app was successful”.
Open the shared model driven app using the Gmail account:
Now, I have opened this shared model driven app using my external user Gmail ID as shown below:
To authenticate to this model-driven app, in my Gmail ID I got the account verification code as shown below. Your external users will be asked to enter a login email where they need to enter their Gmail ID and then the account verification code they receive.
5. Configure Data Permissions
For both internal and guest users, ensure that the Dataverse tables used by the app have appropriate permissions based on the assigned security roles.
Comparing Sharing Model-Driven Apps vs Canvas Apps
While both Model-driven and Canvas apps can be shared in Power Apps, there are notable similarities and differences. The following tables summarize these.
Similarities Between Sharing Model-Driven and Canvas Apps
| Aspect | Explanation |
|---|---|
| Azure AD Integration | Both require adding external users as guest users in Azure AD. |
| Licensing Requirements | Both require users (internal or guest) to have valid Power Apps licenses. |
| Data Permissions | Both apps require proper permissions to access the underlying data sources. |
| Sharing via Power Apps | Apps are shared using the Power Apps Maker Portal by entering user emails. |
| Web and Mobile Access | Both types of apps can be accessed through a browser or the Power Apps mobile app. |
Differences Between Sharing Model-Driven and Canvas Apps
| Aspect | Model-Driven Apps | Canvas Apps |
|---|---|---|
| Primary Data Source | Built exclusively on Dataverse. | Can connect to various data sources (e.g., SharePoint, SQL, Dataverse). |
| Security Model | Uses Dataverse security roles to define access. | Relies on permissions of the data source (e.g., SharePoint list permissions). |
| UI Customization | Limited customization as layouts are pre-built. | Highly customizable with complete control over UI design. |
| Sharing Complexity | Requires assigning Dataverse security roles in addition to app sharing. | Simpler; permissions are based on app and data source sharing. |
| Licensing for Dataverse | Mandatory, as Dataverse is the backend for all Model-driven apps. | Optional; required only when using Dataverse as a data source. |
The model-driven app can be shared with both security type groups as well as Microsoft 365 type groups, whereas the Canvas app can only be shared with security type groups.
Key Considerations When Sharing Model-Driven Apps
1. Managing Licenses
- For guest users, ensure the license aligns with app requirements (e.g., premium connectors).
- For internal users, licenses are typically managed within the organization.
2. Understanding Security Roles
Dataverse security roles are critical for Model-driven apps. Assign roles that balance functionality with data security, ensuring users access only the features and data they need.
3. Supporting Guest Users
- Guest users must accept the Azure AD invitation and log in using the same email.
- They can access apps through the Power Apps portal or mobile app.
4. Testing Access
Before sharing the app widely, test the guest and internal user experience to ensure permissions and roles are configured correctly.
YouTube Video Demo: Share Model Driven App With External Guest Users
Conclusion: Share Model Driven App With External and Member Users
Thus, in this article, we have learnt about how to share model-driven apps in Power Apps with external or guest users and internal users in your organization with Microsoft best practices.
Sharing Model-driven apps with internal and guest users is an essential feature of Power Platform that enhances collaboration across organizations. While the process involves some complexities, particularly around Dataverse security roles, following the steps and best practices outlined above ensures a seamless sharing experience.
By understanding the similarities and differences between Model-driven and Canvas apps, you can make informed decisions on how to collaborate effectively using Power Apps.
Common FAQs: Share Model-driven App in Power Apps
Q1. Can I share a Model-driven app without using Dataverse?
No, Model-driven apps are built on Dataverse and require Dataverse for data storage and operations.
Q2. What happens if a guest user doesn’t have a license?
If a guest user lacks a Power Apps license, they’ll see an error prompting them to get a license or contact their admin.
Q3. Can guest users modify a Model-driven app?
Guest users cannot modify apps unless assigned Co-owner permissions, which is uncommon for external users.
Q4. Are Canvas apps easier to share than Model-driven apps?
Yes, Canvas apps are generally easier to share because they don’t require Dataverse security roles.
Q5. Can I use the same Power Apps license for both Model-driven and Canvas apps?
Yes, as long as the license (e.g., Per App Plan) supports the app’s features and data sources.
Q6. Can I share a Model-driven app with external users outside my organization?
Yes, you can share a Model-driven app with external users by inviting them as guest users in your Azure Active Directory and assigning the necessary Dataverse security roles and licenses.
Q7. What licenses do I need to assign to a guest user for Model-driven apps?
Guest users require a Power Apps license, such as the Per App Plan or Per User Plan, depending on the app’s features and their access requirements.
Q8. Can external users access Model-driven apps via mobile devices?
Yes, external users can access Model-driven apps on mobile devices using the Power Apps mobile app, provided they have the necessary permissions and licenses.
Q9. What security roles do I need to assign for external users in Model-driven apps?
You must assign appropriate Dataverse security roles that define what external users can view or edit in the app. Roles like Basic User or custom roles with specific permissions are commonly used.
Q10. Can external users see all data in the Model-driven app?
No, external users can only see data they are permitted to access based on the assigned Dataverse security roles and row-level security settings.
Q11. Is sharing a Model-driven app dependent on Azure AD settings?
Yes, sharing a Model-driven app requires proper configuration in Azure Active Directory, including inviting external users as guest users and adding them to appropriate security groups.
Q12. Can I use a security group for sharing Model-driven apps like in Canvas apps?
Yes, you can use Azure AD security groups to streamline the sharing process for both Model-driven and Canvas apps. Ensure the group has the correct roles and permissions.
Q13. What’s the difference in guest user experience between Model-driven and Canvas apps?
Guest users in Canvas apps have a more customizable and user-friendly experience, while Model-driven apps provide a more structured interface tied closely to Dataverse data.
Q14. Do Model-driven apps require explicit environment access for guest users?
Yes, guest users must have access to the environment where the Model-driven app is hosted, and they must also be assigned the necessary security roles within Dataverse.
Q15. Can I track external users’ activities in Model-driven apps?
Yes, you can monitor external users’ activities using Dataverse auditing features, which track app usage, data access, and changes.
Q16. Can guest users integrate Model-driven apps with other Microsoft 365 tools?
Yes, guest users can integrate Model-driven apps with other tools like Microsoft Teams or Power BI, provided they have the necessary permissions and licenses.
Q17. What happens if a guest user’s invitation is not accepted?
If a guest user does not accept the Azure AD invitation, they will not be able to access the Model-driven app or any resources shared with them.
Q18. Can Model-driven apps use SharePoint as a data source for guest users?
No, Model-driven apps are designed to work with Dataverse as the primary data source, unlike Canvas apps that can connect to various external data sources, including SharePoint.
About Post Author
