Skip to content

Commit af515db

Browse files
reshmee011reshmee011
authored
Merge pull request #5168 from siddharth-vaghasia/RemovePowerAppsPermissions
Added new command to Remove Power Apps permissions
2 parents e8e7b40 + ca88eb7 commit af515db

File tree

2 files changed

+313
-0
lines changed

2 files changed

+313
-0
lines changed

‎documentation/Remove-PnPPowerAppPermission.md‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
---
2+
Module Name: PnP.PowerShell
3+
schema: 2.0.0
4+
applicable: SharePoint Online
5+
online version: https://pnp.github.io/powershell/cmdlets/Remove-PnPPowerAppPermission.html
6+
external help file: PnP.PowerShell.dll-Help.xml
7+
title: Remove-PnPPowerAppPermission
8+
---
9+
10+
# Remove-PnPPowerAppPermission
11+
12+
## SYNOPSIS
13+
14+
**Required Permissions**
15+
16+
* Azure: management.azure.com
17+
* PowerApps: service.powerapps.com
18+
* Microsoft Graph: User.Read.All, Group.Read.All
19+
20+
Removes user, group and (Everyone in organization) permissions from a Power App
21+
22+
23+
## SYNTAX
24+
25+
```powershell
26+
Remove-PnPPowerAppPermission [-Environment <PowerAutomateEnvironmentPipeBind>] -Identity <PowerPlatformPipeBind> [-User <String>] [-Group <String>] [-Tenant] [-AsAdmin] [-Force] [-Verbose]
27+
```
28+
29+
## DESCRIPTION
30+
This cmdlet removes user, group, or (Everyone in organization) permissions from a PowerApp using the -User, -Group, or -Tenant parameter. Only one of these parameters can be specified at a time, and at least one must be provided.
31+
32+
## EXAMPLES
33+
34+
### Example 1
35+
```powershell
36+
Remove-PnPPowerAppPermission -Identity 9b2f87e6-4c3d-48c0-a2b6-c1b4e3e57f0f -User username@tenant.onmicrosoft.com
37+
```
38+
Removes the specified user permission from the specified PowerApp located in the default environment using user's UPN
39+
40+
### Example 2
41+
```powershell
42+
Remove-PnPPowerAppPermission -Identity 9b2f87e6-4c3d-48c0-a2b6-c1b4e3e57f0f -User 6844c04a-8ee7-40ad-af66-28f6e948cd04
43+
```
44+
Removes the specified user permission from the specified PowerApp located in the default environment using user's Id
45+
46+
### Example 3
47+
```powershell
48+
Remove-PnPPowerAppPermission -Environment (Get-PnPPowerPlatformEnvironment -Identity "myenvironment") -Identity 9b2f87e6-4c3d-48c0-a2b6-c1b4e3e57f0f -User username@tenant.onmicrosoft.com -AsAdmin
49+
```
50+
Removes the specified user permission from the specified PowerApp as an admin in the specified environment
51+
52+
### Example 4
53+
```powershell
54+
Remove-PnPPowerAppPermission -Environment (Get-PnPPowerPlatformEnvironment -Identity "myenvironment) -Identity 9b2f87e6-4c3d-48c0-a2b6-c1b4e3e57f0f -User username@tenant.onmicrosoft.com -AsAdmin -Force
55+
```
56+
Removes the specified user permission from the specified PowerApp as admin, without asking for confirmation, in the specified environment
57+
58+
### Example 5
59+
```powershell
60+
Remove-PnPPowerAppPermission -Identity "3f4a2c1d-0e9d-4c1e-8b55-9e3c7f0ba7e2" -Group "c6c4b4e0-cd72-4d64-8ec2-cfbd0388ec16" -Force
61+
```
62+
Removes the specified group's permission for the PowerApp without prompting using group id
63+
64+
### Example 6
65+
```powershell
66+
Remove-PnPPowerAppPermission -Identity "3f4a2c1d-0e9d-4c1e-8b55-9e3c7f0ba7e2" -Group "Finance Team"
67+
```
68+
Removes the specified group's permission for the PowerApp using group's display name
69+
70+
### Example 7
71+
```powershell
72+
Remove-PnPPowerAppPermission -Identity "3f4a2c1d-0e9d-4c1e-8b55-9e3c7f0ba7e2" -Tenant
73+
```
74+
Removes the (Everyone in organization) permission for the PowerApp using -Tenant parameter
75+
76+
## PARAMETERS
77+
78+
### -Environment
79+
The name of the Power Platform environment or an Environment instance. If omitted, the default environment will be used.
80+
81+
```yaml
82+
Type: PowerPlatformEnvironmentPipeBind
83+
Parameter Sets: (All)
84+
Aliases:
85+
86+
Required: False
87+
Position: Named
88+
Default value: The default environment
89+
Accept pipeline input: True
90+
Accept wildcard characters: False
91+
```
92+
93+
### -Identity
94+
The Name, Id or instance of the PowerApp to remove the permissions from.
95+
96+
```yaml
97+
Type: PowerPlatformPipeBind
98+
Parameter Sets: (All)
99+
Aliases:
100+
101+
Required: True
102+
Position: Named
103+
Default value: None
104+
Accept pipeline input: False
105+
Accept wildcard characters: False
106+
```
107+
108+
### -User
109+
The user principal name or Id of the user to remove its permissions from the PowerApp.
110+
111+
```yaml
112+
Type: String
113+
Parameter Sets: (All)
114+
115+
Required: False
116+
Position: Named
117+
Default value: None
118+
Accept pipeline input: False
119+
Accept wildcard characters: False
120+
```
121+
122+
### -Group
123+
The group display name or Id of the group to remove its permissions from the PowerApp.
124+
125+
```yaml
126+
Type: String
127+
Parameter Sets: (All)
128+
129+
Required: False
130+
Position: Named
131+
Default value: None
132+
Accept pipeline input: False
133+
Accept wildcard characters: False
134+
```
135+
136+
### -Tenant
137+
The (Everyone in organization) permission to remove from the PowerApp
138+
139+
```yaml
140+
Type: String
141+
Parameter Sets: (All)
142+
143+
Required: False
144+
Position: Named
145+
Default value: None
146+
Accept pipeline input: False
147+
Accept wildcard characters: False
148+
```
149+
150+
### -AsAdmin
151+
If specified, the permission will be removed as an admin. If not specified only the Apps to which the current user already has access can be modified.
152+
153+
```yaml
154+
Type: SwitchParameter
155+
Parameter Sets: (All)
156+
Aliases:
157+
158+
Required: False
159+
Position: Named
160+
Default value: None
161+
Accept pipeline input: False
162+
Accept wildcard characters: False
163+
```
164+
165+
### -Force
166+
Providing the Force parameter will skip the confirmation question.
167+
168+
```yaml
169+
Type: SwitchParameter
170+
Parameter Sets: (All)
171+
172+
Required: False
173+
Position: Named
174+
Default value: None
175+
Accept pipeline input: False
176+
Accept wildcard characters: False
177+
```
178+
179+
## RELATED LINKS
180+
181+
[Microsoft 365 Patterns and Practices](https://aka.ms/m365pnp)

‎src/Commands/PowerPlatform/PowerApps/RemovePowerAppPermission.cs‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
using Microsoft.SharePoint.Client;
2+
using PnP.PowerShell.Commands.Base;
3+
using PnP.PowerShell.Commands.Base.PipeBinds;
4+
using PnP.PowerShell.Commands.Utilities;
5+
using PnP.PowerShell.Commands.Utilities.REST;
6+
using System;
7+
using System.Management.Automation;
8+
9+
namespace PnP.PowerShell.Commands.PowerPlatform.PowerApps
10+
{
11+
[Cmdlet(VerbsCommon.Remove, "PnPPowerAppPermission")]
12+
public class RemovePowerAppPermission : PnPAzureManagementApiCmdlet
13+
{
14+
[Parameter(Mandatory = false)]
15+
public PowerPlatformEnvironmentPipeBind Environment;
16+
17+
[Parameter(Mandatory = true)]
18+
public PowerAppPipeBind Identity;
19+
20+
[Parameter(Mandatory = false)]
21+
public string User;
22+
23+
[Parameter(Mandatory = false)]
24+
public string Group;
25+
26+
[Parameter(Mandatory = false)]
27+
public SwitchParameter Tenant;
28+
29+
[Parameter(Mandatory = false)]
30+
public SwitchParameter AsAdmin;
31+
32+
[Parameter(Mandatory = false)]
33+
public SwitchParameter Force;
34+
35+
protected override void ExecuteCmdlet()
36+
{
37+
var environmentName = ParameterSpecified(nameof(Environment)) ? Environment.GetName() : PowerPlatformUtility.GetDefaultEnvironment(ArmRequestHelper, Connection.AzureEnvironment)?.Name;
38+
if (string.IsNullOrEmpty(environmentName))
39+
{
40+
throw new PSArgumentException("Environment not found.", nameof(Environment));
41+
}
42+
43+
var appName = Identity.GetName();
44+
if (string.IsNullOrEmpty(appName))
45+
{
46+
throw new PSArgumentException("PowerApp not found.", nameof(Identity));
47+
}
48+
49+
if (string.IsNullOrEmpty(User) && string.IsNullOrEmpty(Group) && !Tenant.IsPresent)
50+
{
51+
throw new PSArgumentException("Either User, Group, or Tenant must be specified.");
52+
}
53+
54+
if ((Tenant.IsPresent && (!string.IsNullOrEmpty(User) || !string.IsNullOrEmpty(Group))) ||
55+
(!string.IsNullOrEmpty(User) && !string.IsNullOrEmpty(Group)))
56+
{
57+
throw new PSArgumentException("Specify only one of User, Group, or Tenant.");
58+
}
59+
60+
string graphAccessToken = TokenHandler.GetAccessToken($"https://{Connection.GraphEndPoint}/.default", Connection);
61+
LogDebug("Microsoft Graph access token acquired");
62+
63+
var graphRequestHelper = new ApiRequestHelper(GetType(), Connection, $"https://{Connection.GraphEndPoint}/.default");
64+
65+
string entityId = null ;
66+
67+
if (!string.IsNullOrEmpty(User))
68+
{
69+
LogDebug("Processing User parameter");
70+
Model.AzureAD.User graphUser;
71+
if (Guid.TryParse(User, out Guid userGuid))
72+
{
73+
LogDebug($"Looking up user through Microsoft Graph by user id {userGuid}");
74+
graphUser = Utilities.AzureAdUtility.GetUser(graphAccessToken, userGuid, azureEnvironment: Connection.AzureEnvironment);
75+
}
76+
else
77+
{
78+
LogDebug($"Looking up user through Microsoft Graph by user principal name {User}");
79+
graphUser = Utilities.AzureAdUtility.GetUser(graphAccessToken, User, azureEnvironment: Connection.AzureEnvironment);
80+
}
81+
82+
if (graphUser == null)
83+
{
84+
throw new PSArgumentException("User not found.", nameof(User));
85+
}
86+
87+
entityId = graphUser.Id.ToString();
88+
}
89+
else if (!string.IsNullOrEmpty(Group))
90+
{
91+
LogDebug("Processing Group parameter");
92+
93+
var graphGroup = Guid.TryParse(Group, out Guid groupGuid)
94+
? Utilities.AzureADGroupsUtility.GetGroup(graphRequestHelper, groupGuid)
95+
: Utilities.AzureADGroupsUtility.GetGroup(graphRequestHelper, Group);
96+
97+
if (graphGroup == null)
98+
{
99+
throw new PSArgumentException("Group not found.", nameof(Group));
100+
}
101+
102+
entityId = graphGroup.Id.ToString();
103+
}
104+
else if (Tenant.IsPresent)
105+
{
106+
LogDebug("Processing Tenant parameter");
107+
108+
string TenantGUID = TenantExtensions.GetTenantIdByUrl(Connection.Url, Connection.AzureEnvironment);
109+
entityId = $"tenant-{TenantGUID}";
110+
LogDebug($"Tenant ID resolved: {entityId}");
111+
}
112+
113+
var payload = new
114+
{
115+
delete = new[]
116+
{
117+
new
118+
{
119+
id = entityId,
120+
}
121+
}
122+
};
123+
124+
if (Force || ShouldContinue($"Remove PowerApp permission for entity with id '{entityId}' from app '{appName}'?", Properties.Resources.Confirm))
125+
{
126+
string baseUrl = PowerPlatformUtility.GetPowerAppsEndpoint(Connection.AzureEnvironment);
127+
LogDebug($"Removing entity {entityId} permissions from PowerApp {appName} in environment {environmentName}");
128+
PowerAppsRequestHelper.Post($"{baseUrl}/providers/Microsoft.PowerApps{(AsAdmin ? "/scopes/admin/environments/" + environmentName : "")}/apps/{appName}/modifyPermissions?api-version=2022-11-01", payload);
129+
}
130+
}
131+
}
132+
}

0 commit comments

Comments
 (0)