Skip to content

Fix Power Apps endpoints for government clouds #5404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gautamdsheth merged 2 commits into from
Jul 18, 2026
Merged

Fix Power Apps endpoints for government clouds #5404

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
786a59c
Fix Power Apps endpoints for government clouds
gautamdsheth Jul 18, 2026
b7fa1ec
Update changelog link for Power Apps endpoint fix
gautamdsheth Jul 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
- Fixed an issue with `Add-PnPListItem` and `Set-PnPListItem` cmdlets when trying to set taxonomy fields by passing in a GUID or term instance using a Batch. [#5174](https://github.com/pnp/powershell/pull/5174)
- Fixed issue with Azure functions not working properly when we also have other modules like Az which rely on .NET 10. [#5393](https://github.com/pnp/powershell/pull/5393)
- Fixed multi-geo compatibility issues with `Get-PnPGeoAdministrator` response handling, `Set-PnPMultiGeoExperience` confirmation prompts, and unsupported-version errors for `Set-PnPMultiGeoCompanyAllowedDataLocation`. [#5401](https://github.com/pnp/powershell/pull/5401)
- Fixed Power Apps cmdlets to use cloud-specific Power Apps service audiences and endpoints for government clouds. [#5404](https://github.com/pnp/powershell/pull/5404)

### Removed

Expand Down
1 change: 1 addition & 0 deletions documentation/Get-PnPPowerApp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ title: Get-PnPPowerApp
**Required Permissions**

* Azure: management.azure.com
* PowerApps: service.powerapps.com

Returns the Power Apps for a given environment

Expand Down
1 change: 1 addition & 0 deletions documentation/Set-PnPPowerAppByPassConsent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ title: Set-PnPPowerAppByPassConsent
**Required Permissions**

* Azure: management.azure.com
* PowerApps: service.powerapps.com

Sets the consent bypass flag of a Power Apps for a given environment

Expand Down
3 changes: 2 additions & 1 deletion src/Commands/Base/PnPAzureManagementApiCmdlet.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
using System.Management.Automation;
using Microsoft.SharePoint.Client;
using PnP.PowerShell.Commands.Utilities;
using PnP.PowerShell.Commands.Utilities.Auth;
using PnP.PowerShell.Commands.Utilities.REST;

Expand All @@ -18,7 +19,7 @@ public abstract class PnPAzureManagementApiCmdlet : PnPConnectedCmdlet
/// <summary>
/// The default audience to target PowerApps APIs
/// </summary>
public string PowerAppDefaultAudience => "https://service.powerapps.com/.default";
public string PowerAppDefaultAudience => $"{PowerPlatformUtility.GetPowerAppsServiceEndpoint(Connection.AzureEnvironment)}/.default";

/// <summary>
/// Returns an Access Token for the Microsoft Office Management API, if available, otherwise NULL
Expand Down
12 changes: 11 additions & 1 deletion src/Commands/Base/TokenHandler.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,17 @@ internal static Enums.ResourceTypeName DefineResourceTypeFromAudience(string aud
"azure" or "management.azure.com" or "management.chinacloudapi.cn" or "management.usgovcloudapi.net" => Enums.ResourceTypeName.AzureManagementApi,
"exchangeonline" or "outlook.office.com" or "outlook.office365.com" => Enums.ResourceTypeName.ExchangeOnline,
"flow" or "service.flow.microsoft.com" => Enums.ResourceTypeName.PowerAutomate,
"powerapps" or "api.powerapps.com" => Enums.ResourceTypeName.PowerApps,
"powerapps"
or "api.powerapps.com"
or "service.powerapps.com"
or "api.powerapps.cn"
or "service.powerapps.cn"
or "gov.api.powerapps.us"
or "gov.service.powerapps.us"

@gautamdsheth gautamdsheth Jul 18, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I validated this together with the endpoint mapping comment and I don't think service.powerapps.us is the correct audience to add here. The first-party Power Apps admin module recognizes gov.api.powerapps.us with the https://gov.service.powerapps.us/ audience, and Microsoft Learn documents the same GCC resource URI. Keeping gov.service.powerapps.us classified as PowerApps is therefore intentional.

or "high.api.powerapps.us"
or "high.service.powerapps.us"
or "api.apps.appsplatform.us"
or "service.apps.appsplatform.us" => Enums.ResourceTypeName.PowerApps,
"dynamics" or "admin.services.crm.dynamics.com" or "api.crm.dynamics.com" => Enums.ResourceTypeName.DynamicsCRM,
"gcs" or "gcs.office.com" => Enums.ResourceTypeName.Gcs,

Expand Down
5 changes: 4 additions & 1 deletion src/Commands/PowerPlatform/PowerApps/GetPowerApp.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,10 @@ protected override void ExecuteCmdlet()
{
LogDebug($"Retrieving all PowerApps within environment '{environmentName}'");

var apps = PowerAppsRequestHelper.GetResultCollection<Model.PowerPlatform.PowerApp.PowerApp>($"{powerAppsUrl}/providers/Microsoft.PowerApps/apps?api-version=2016-11-01&$filter=environment eq '{environmentName}'");
var requestUrl = AsAdmin
? $"{powerAppsUrl}/providers/Microsoft.PowerApps/scopes/admin/environments/{environmentName}/apps?api-version=2016-11-01"
: $"{powerAppsUrl}/providers/Microsoft.PowerApps/apps?api-version=2016-11-01&$filter=environment eq '{environmentName}'";
var apps = PowerAppsRequestHelper.GetResultCollection<Model.PowerPlatform.PowerApp.PowerApp>(requestUrl);
WriteObject(apps, true);
}
}
Expand Down
34 changes: 32 additions & 2 deletions src/Commands/Utilities/PowerPlatformUtility.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
using PnP.Framework;
using System;
using PnP.Framework;
using PnP.PowerShell.Commands.Utilities.REST;
using System.Linq;
using PnP.Framework.Diagnostics;
Expand Down Expand Up @@ -26,6 +27,7 @@ public static string GetPowerAutomateEndpoint(AzureEnvironment environment)
AzureEnvironment.USGovernmentHigh => "https://high.api.flow.microsoft.us",
AzureEnvironment.USGovernmentDoD => "https://api.flow.appsplatform.us",
AzureEnvironment.PPE => "https://api.flow.microsoft.com",
AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment),
_ => "https://api.flow.microsoft.com"
};
}
Expand All @@ -41,15 +43,37 @@ public static string GetPowerAppsEndpoint(AzureEnvironment environment)
{
AzureEnvironment.Production => "https://api.powerapps.com",
AzureEnvironment.Germany => "https://api.powerapps.com",
AzureEnvironment.China => "https://api.powerautomate.cn",
AzureEnvironment.China => "https://api.powerapps.cn",
AzureEnvironment.USGovernment => "https://gov.api.powerapps.us",
AzureEnvironment.USGovernmentHigh => "https://high.api.powerapps.us",
AzureEnvironment.USGovernmentDoD => "https://api.apps.appsplatform.us",
AzureEnvironment.PPE => "https://api.powerapps.com",
AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment),
_ => "https://api.powerapps.com"
};
}

/// <summary>
/// Returns the audience URL for acquiring tokens for Power Apps APIs based on the Azure Environment
/// </summary>
/// <param name="environment">Azure Environment to indicate the type of cloud to target</param>
/// <returns>Audience URL for acquiring tokens for Power Apps APIs</returns>
public static string GetPowerAppsServiceEndpoint(AzureEnvironment environment)
{
return environment switch
{
AzureEnvironment.Production => "https://service.powerapps.com",
AzureEnvironment.Germany => "https://service.powerapps.com",
AzureEnvironment.China => "https://service.powerapps.cn",
AzureEnvironment.USGovernment => "https://gov.service.powerapps.us",

@gautamdsheth gautamdsheth Jul 18, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I validated this against Microsoft sources and I don't think this change is correct. The current Microsoft.PowerApps.Administration.PowerShell module maps Add-PowerAppsAccount -Endpoint usgov to https://gov.service.powerapps.us/, and its REST host mapping maps gov.api.powerapps.us to the same https://gov.service.powerapps.us/ audience. Microsoft Learn's Power Shield connection-reference table also lists GCC's Microsoft Entra resource URI as https://gov.service.powerapps.us/. So changing GCC to service.powerapps.us would diverge from the first-party module/docs.

AzureEnvironment.USGovernmentHigh => "https://high.service.powerapps.us",
AzureEnvironment.USGovernmentDoD => "https://service.apps.appsplatform.us",
AzureEnvironment.PPE => "https://service.powerapps.com",
AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment),
_ => "https://service.powerapps.com"
};
}

/// <summary>
/// Returns the BaseUrl for calling into the Business Applications APIs based on the Azure Environment
/// </summary>
Expand All @@ -66,10 +90,16 @@ public static string GetBapEndpoint(AzureEnvironment environment)
AzureEnvironment.USGovernmentHigh => "https://high.api.bap.microsoft.us",
AzureEnvironment.USGovernmentDoD => "https://api.bap.appsplatform.us",
AzureEnvironment.PPE => "https://api.bap.microsoft.com",
AzureEnvironment.BleuCloud or AzureEnvironment.DelosCloud or AzureEnvironment.GovSGCloud => throw GetUnsupportedPowerPlatformCloudException(environment),
_ => "https://api.bap.microsoft.com"
};
}

private static NotSupportedException GetUnsupportedPowerPlatformCloudException(AzureEnvironment environment)
{
return new NotSupportedException($"Power Platform endpoints for AzureEnvironment '{environment}' are not currently documented or supported.");
}

/// <summary>
/// Returns the default Power Platform environment
/// </summary>
Expand Down
Loading