From 786a59cd6a116f945f29a32b6b27b7260b2f09c6 Mon Sep 17 00:00:00 2001 From: Gautam Sheth Date: Sat, 18 Jul 2026 17:29:25 +0300 Subject: [PATCH 1/2] Fix Power Apps endpoints for government clouds Use cloud-specific Power Apps service audiences when acquiring tokens, and keep admin Power Apps list calls on the admin-scoped endpoint. Also avoid silently falling back to public-cloud Power Platform endpoints for sovereign clouds without documented support. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 1 + documentation/Get-PnPPowerApp.md | 1 + documentation/Set-PnPPowerAppByPassConsent.md | 1 + .../Base/PnPAzureManagementApiCmdlet.cs | 3 +- src/Commands/Base/TokenHandler.cs | 12 ++++++- .../PowerPlatform/PowerApps/GetPowerApp.cs | 5 ++- .../Utilities/PowerPlatformUtility.cs | 34 +++++++++++++++++-- 7 files changed, 52 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b6ce97bf9..a3bdb02657 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/). - Fixed an issue with `Add-PnPListItem` and `Set-PnPListItem` cmdlets when trying to set taxonomy fields by passing in a GUID or term instance using a Batch. [#5174](https://github.com/pnp/powershell/pull/5174) - Fixed issue with Azure functions not working properly when we also have other modules like Az which rely on .NET 10. [#5393](https://github.com/pnp/powershell/pull/5393) - Fixed multi-geo compatibility issues with `Get-PnPGeoAdministrator` response handling, `Set-PnPMultiGeoExperience` confirmation prompts, and unsupported-version errors for `Set-PnPMultiGeoCompanyAllowedDataLocation`. [#5401](https://github.com/pnp/powershell/pull/5401) +- Fixed Power Apps cmdlets to use cloud-specific Power Apps service audiences and endpoints for government clouds. [#5400](https://github.com/pnp/powershell/issues/5400) ### Removed diff --git a/documentation/Get-PnPPowerApp.md b/documentation/Get-PnPPowerApp.md index 10a29fa114..b6616c828e 100644 --- a/documentation/Get-PnPPowerApp.md +++ b/documentation/Get-PnPPowerApp.md @@ -14,6 +14,7 @@ title: Get-PnPPowerApp **Required Permissions** * Azure: management.azure.com +* PowerApps: service.powerapps.com Returns the Power Apps for a given environment diff --git a/documentation/Set-PnPPowerAppByPassConsent.md b/documentation/Set-PnPPowerAppByPassConsent.md index be34ee4274..57824a80a0 100644 --- a/documentation/Set-PnPPowerAppByPassConsent.md +++ b/documentation/Set-PnPPowerAppByPassConsent.md @@ -14,6 +14,7 @@ title: Set-PnPPowerAppByPassConsent **Required Permissions** * Azure: management.azure.com +* PowerApps: service.powerapps.com Sets the consent bypass flag of a Power Apps for a given environment diff --git a/src/Commands/Base/PnPAzureManagementApiCmdlet.cs b/src/Commands/Base/PnPAzureManagementApiCmdlet.cs index c1f1acc3c9..349b9e0757 100644 --- a/src/Commands/Base/PnPAzureManagementApiCmdlet.cs +++ b/src/Commands/Base/PnPAzureManagementApiCmdlet.cs @@ -1,5 +1,6 @@ using System.Management.Automation; using Microsoft.SharePoint.Client; +using PnP.PowerShell.Commands.Utilities; using PnP.PowerShell.Commands.Utilities.Auth; using PnP.PowerShell.Commands.Utilities.REST; @@ -18,7 +19,7 @@ public abstract class PnPAzureManagementApiCmdlet : PnPConnectedCmdlet /// /// The default audience to target PowerApps APIs /// - public string PowerAppDefaultAudience => "https://service.powerapps.com/.default"; + public string PowerAppDefaultAudience => $"{PowerPlatformUtility.GetPowerAppsServiceEndpoint(Connection.AzureEnvironment)}/.default"; /// /// Returns an Access Token for the Microsoft Office Management API, if available, otherwise NULL diff --git a/src/Commands/Base/TokenHandler.cs b/src/Commands/Base/TokenHandler.cs index fe00279e4a..1123f9d62c 100644 --- a/src/Commands/Base/TokenHandler.cs +++ b/src/Commands/Base/TokenHandler.cs @@ -125,7 +125,17 @@ internal static Enums.ResourceTypeName DefineResourceTypeFromAudience(string aud "azure" or "management.azure.com" or "management.chinacloudapi.cn" or "management.usgovcloudapi.net" => Enums.ResourceTypeName.AzureManagementApi, "exchangeonline" or "outlook.office.com" or "outlook.office365.com" => Enums.ResourceTypeName.ExchangeOnline, "flow" or "service.flow.microsoft.com" => Enums.ResourceTypeName.PowerAutomate, - "powerapps" or "api.powerapps.com" => Enums.ResourceTypeName.PowerApps, + "powerapps" + or "api.powerapps.com" + or "service.powerapps.com" + or "api.powerapps.cn" + or "service.powerapps.cn" + or "gov.api.powerapps.us" + or "gov.service.powerapps.us" + or "high.api.powerapps.us" + or "high.service.powerapps.us" + or "api.apps.appsplatform.us" + or "service.apps.appsplatform.us" => Enums.ResourceTypeName.PowerApps, "dynamics" or "admin.services.crm.dynamics.com" or "api.crm.dynamics.com" => Enums.ResourceTypeName.DynamicsCRM, "gcs" or "gcs.office.com" => Enums.ResourceTypeName.Gcs, diff --git a/src/Commands/PowerPlatform/PowerApps/GetPowerApp.cs b/src/Commands/PowerPlatform/PowerApps/GetPowerApp.cs index 968778ad09..1d909c473a 100644 --- a/src/Commands/PowerPlatform/PowerApps/GetPowerApp.cs +++ b/src/Commands/PowerPlatform/PowerApps/GetPowerApp.cs @@ -40,7 +40,10 @@ protected override void ExecuteCmdlet() { LogDebug($"Retrieving all PowerApps within environment '{environmentName}'"); - var apps = PowerAppsRequestHelper.GetResultCollection($"{powerAppsUrl}/providers/Microsoft.PowerApps/apps?api-version=2016-11-01&$filter=environment eq '{environmentName}'"); + var requestUrl = AsAdmin + ? $"{powerAppsUrl}/providers/Microsoft.PowerApps/scopes/admin/environments/{environmentName}/apps?api-version=2016-11-01" + : $"{powerAppsUrl}/providers/Microsoft.PowerApps/apps?api-version=2016-11-01&$filter=environment eq '{environmentName}'"; + var apps = PowerAppsRequestHelper.GetResultCollection(requestUrl); WriteObject(apps, true); } } diff --git a/src/Commands/Utilities/PowerPlatformUtility.cs b/src/Commands/Utilities/PowerPlatformUtility.cs index ffe147861a..01178149c5 100644 --- a/src/Commands/Utilities/PowerPlatformUtility.cs +++ b/src/Commands/Utilities/PowerPlatformUtility.cs @@ -1,4 +1,5 @@ -using PnP.Framework; +using System; +using PnP.Framework; using PnP.PowerShell.Commands.Utilities.REST; using System.Linq; using PnP.Framework.Diagnostics; @@ -26,6 +27,7 @@ public static string GetPowerAutomateEndpoint(AzureEnvironment environment) AzureEnvironment.USGovernmentHigh => "https://high.api.flow.microsoft.us", AzureEnvironment.USGovernmentDoD => "https://api.flow.appsplatform.us", AzureEnvironment.PPE => "https://api.flow.microsoft.com", + AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment), _ => "https://api.flow.microsoft.com" }; } @@ -41,15 +43,37 @@ public static string GetPowerAppsEndpoint(AzureEnvironment environment) { AzureEnvironment.Production => "https://api.powerapps.com", AzureEnvironment.Germany => "https://api.powerapps.com", - AzureEnvironment.China => "https://api.powerautomate.cn", + AzureEnvironment.China => "https://api.powerapps.cn", AzureEnvironment.USGovernment => "https://gov.api.powerapps.us", AzureEnvironment.USGovernmentHigh => "https://high.api.powerapps.us", AzureEnvironment.USGovernmentDoD => "https://api.apps.appsplatform.us", AzureEnvironment.PPE => "https://api.powerapps.com", + AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment), _ => "https://api.powerapps.com" }; } + /// + /// Returns the audience URL for acquiring tokens for Power Apps APIs based on the Azure Environment + /// + /// Azure Environment to indicate the type of cloud to target + /// Audience URL for acquiring tokens for Power Apps APIs + public static string GetPowerAppsServiceEndpoint(AzureEnvironment environment) + { + return environment switch + { + AzureEnvironment.Production => "https://service.powerapps.com", + AzureEnvironment.Germany => "https://service.powerapps.com", + AzureEnvironment.China => "https://service.powerapps.cn", + AzureEnvironment.USGovernment => "https://gov.service.powerapps.us", + AzureEnvironment.USGovernmentHigh => "https://high.service.powerapps.us", + AzureEnvironment.USGovernmentDoD => "https://service.apps.appsplatform.us", + AzureEnvironment.PPE => "https://service.powerapps.com", + AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment), + _ => "https://service.powerapps.com" + }; + } + /// /// Returns the BaseUrl for calling into the Business Applications APIs based on the Azure Environment /// @@ -66,10 +90,16 @@ public static string GetBapEndpoint(AzureEnvironment environment) AzureEnvironment.USGovernmentHigh => "https://high.api.bap.microsoft.us", AzureEnvironment.USGovernmentDoD => "https://api.bap.appsplatform.us", AzureEnvironment.PPE => "https://api.bap.microsoft.com", + AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment), _ => "https://api.bap.microsoft.com" }; } + private static NotSupportedException GetUnsupportedPowerPlatformCloudException(AzureEnvironment environment) + { + return new NotSupportedException($"Power Platform endpoints for AzureEnvironment '{environment}' are not currently documented or supported."); + } + /// /// Returns the default Power Platform environment /// From b7fa1ecb462f49733965c272e80b5eaff321af84 Mon Sep 17 00:00:00 2001 From: Gautam Sheth Date: Sat, 18 Jul 2026 17:30:13 +0300 Subject: [PATCH 2/2] Update changelog link for Power Apps endpoint fix Link the Current nightly changelog entry to the pull request. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a3bdb02657..de71694bde 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,7 +19,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/). - Fixed an issue with `Add-PnPListItem` and `Set-PnPListItem` cmdlets when trying to set taxonomy fields by passing in a GUID or term instance using a Batch. [#5174](https://github.com/pnp/powershell/pull/5174) - Fixed issue with Azure functions not working properly when we also have other modules like Az which rely on .NET 10. [#5393](https://github.com/pnp/powershell/pull/5393) - Fixed multi-geo compatibility issues with `Get-PnPGeoAdministrator` response handling, `Set-PnPMultiGeoExperience` confirmation prompts, and unsupported-version errors for `Set-PnPMultiGeoCompanyAllowedDataLocation`. [#5401](https://github.com/pnp/powershell/pull/5401) -- Fixed Power Apps cmdlets to use cloud-specific Power Apps service audiences and endpoints for government clouds. [#5400](https://github.com/pnp/powershell/issues/5400) +- Fixed Power Apps cmdlets to use cloud-specific Power Apps service audiences and endpoints for government clouds. [#5404](https://github.com/pnp/powershell/pull/5404) ### Removed