Guest User App Sharing Audit

Overview

FlowLibs - Guest User App Sharing Audit is a scheduled governance flow that audits all Power Apps in a target environment for external/guest user sharing. It uses the Power Apps for Admins connector to enumerate every app and its role assignments, filters for guest principals (by type or #EXT# email pattern), logs a summary to Dataverse, and emails the admin a formatted HTML report. If no guest sharing is detected, it sends an all-clear confirmation instead.

Use Case

Organizations using Power Platform often need to know which canvas apps have been shared with external (guest) users. This flow automates that audit on a weekly schedule, replacing manual reviews and catching accidentally shared apps before they become a compliance issue.

The flow is ideal for teams that:

• IT Admins
• Security & Compliance teams

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Import the solution

Import the FlowLibsGuestUserAppSharingAudit solution into your target environment.

Update environment variable values

Set flowlibs_TargetEnvironmentName to your environment ID, set flowlibs_AdminAlertRecipientEmail to your admin's email, and optionally customize flowlibs_GuestAuditReportSubject.

Authorize connections

Open the flow in the designer and authorize connections for Power Apps for Admins, Dataverse, and Outlook.

Turn on the flow

Toggle the flow from Off to On after connections and env vars are configured.

Adjust the schedule

Modify the Recurrence trigger to a different frequency (daily, bi-weekly, etc.) if weekly is not the right cadence for your team.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@or(equals(item()?['properties/principal/type'], 'Guest'), contains(coalesce(item()?['properties/principal/email'], ''), '#EXT#'))

<tr><td>@{items('Loop_Each_App')?['properties/displayName']}</td><td>@{items('Loop_Each_Guest')?['properties/principal/email']}</td><td>@{items('Loop_Each_Guest')?['properties/principal/displayName']}</td><td>@{items('Loop_Each_Guest')?['properties/roleName']}</td></tr>

Guest Audit - @{formatDateTime(utcNow(), 'yyyy-MM-dd')}