Fix Power Apps endpoints for government clouds#5404
Conversation
Use cloud-specific Power Apps service audiences when acquiring tokens, and keep admin Power Apps list calls on the admin-scoped endpoint. Also avoid silently falling back to public-cloud Power Platform endpoints for sovereign clouds without documented support. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Link the Current nightly changelog entry to the pull request. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Fixes Power Apps support across sovereign clouds by selecting cloud-specific API and authentication endpoints.
Changes:
- Adds sovereign-cloud Power Apps endpoints and unsupported-cloud errors.
- Uses the admin-scoped endpoint for
Get-PnPPowerApp -AsAdmin. - Updates permission documentation and changelog.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
src/Commands/Utilities/PowerPlatformUtility.cs |
Maps Power Platform endpoints by cloud. |
src/Commands/PowerPlatform/PowerApps/GetPowerApp.cs |
Uses the admin endpoint for admin list requests. |
src/Commands/Base/TokenHandler.cs |
Classifies sovereign Power Apps audiences. |
src/Commands/Base/PnPAzureManagementApiCmdlet.cs |
Selects the Power Apps token audience by cloud. |
documentation/Set-PnPPowerAppByPassConsent.md |
Documents Power Apps permissions. |
documentation/Get-PnPPowerApp.md |
Documents Power Apps permissions. |
CHANGELOG.md |
Records the government-cloud fix. |
| AzureEnvironment.Production => "https://service.powerapps.com", | ||
| AzureEnvironment.Germany => "https://service.powerapps.com", | ||
| AzureEnvironment.China => "https://service.powerapps.cn", | ||
| AzureEnvironment.USGovernment => "https://gov.service.powerapps.us", |
There was a problem hiding this comment.
I validated this against Microsoft sources and I don't think this change is correct. The current Microsoft.PowerApps.Administration.PowerShell module maps Add-PowerAppsAccount -Endpoint usgov to https://gov.service.powerapps.us/, and its REST host mapping maps gov.api.powerapps.us to the same https://gov.service.powerapps.us/ audience. Microsoft Learn's Power Shield connection-reference table also lists GCC's Microsoft Entra resource URI as https://gov.service.powerapps.us/. So changing GCC to service.powerapps.us would diverge from the first-party module/docs.
| or "api.powerapps.cn" | ||
| or "service.powerapps.cn" | ||
| or "gov.api.powerapps.us" | ||
| or "gov.service.powerapps.us" |
There was a problem hiding this comment.
I validated this together with the endpoint mapping comment and I don't think service.powerapps.us is the correct audience to add here. The first-party Power Apps admin module recognizes gov.api.powerapps.us with the https://gov.service.powerapps.us/ audience, and Microsoft Learn documents the same GCC resource URI. Keeping gov.service.powerapps.us classified as PowerApps is therefore intentional.
Before creating a pull request, make sure that you have read the contribution file located at
https://github.com/pnp/powerShell/blob/dev/CONTRIBUTING.md
Type
Related Issues?
Fixes #5400
What is in this Pull Request ?
This PR fixes Power Apps cmdlets in government cloud connections by using cloud-specific Power Apps service audiences when acquiring tokens while keeping REST calls on the matching cloud-specific API endpoint.
It also updates
Get-PnPPowerApp -AsAdminlist calls to use the admin-scoped Power Apps endpoint, corrects the China Power Apps API endpoint, documents the additional Power Apps permission requirement for affected cmdlets, and prevents unsupported sovereign cloud values from silently falling back to public Power Platform endpoints when Microsoft has not documented Power Platform endpoint support for those clouds.