The Power Apps per App licenses work with so called App Passes. A license for any specific app is not directly assigned to a user, rather it’s automatically assigned when a user starts using an app.
First you’ll have to purchase the appropriate licenses for your users. The amount of licenses you buy relates to the amount of users you want to license for each app.
Each Power Apps per App license is good for access to 2 apps (Model-driven or Canvas) + 1 portal.
- If your organization has 25 users and you want all of them to access 1 Model-driven app, you’ll need 25 Power Apps per App licenses
- If your organization has 25 users and you want all of them to access 1 Canvas app AND 1 Model-driven app, you’ll still only need 25 Power Apps per App licenses, because each is good for 2 apps.
- If your organization has 25 users and you want 10 of them to use app A, and the remainder needs to use app B, you’ll still only need 25 Power Apps per App licenses, because the App Passes would be automatically be assigned to different apps
Assigning the licenses
Purchase the license amount you need
Via the Power Platform Admin Center, allocate the App Passes to the environment, in which the apps resides.
Go To Analytics > Capacity and click Manage to allocate the App Passes.
Apply for the Power Apps per app baseline access license, this special license allows you to assign the per App licenses to your users.
You can apply for this license using this link: https://signup.microsoft.com/signup?sku=bf666882-9c9b-4b2e-aa2f-4789b0a52ba2
Note: You’ll need to sign in with a Global Administrator account inside the tenant, in which you want to consume the licenses. Delegated admin access will not work.
Open the Azure Portal with any administrator account and go to the Licenses blade, there you will find the new license to assign
Using the Assign button, you can either assign licenses to an Azure AD group, or to a specific license.
Note: Only tenants with Azure AD Premium or Office 365 E3/E5 will have the capability to assign licenses to an Azure AD group.
Enable App Passes for your specific app
Canvas Apps can be configured to automatically assign App Passes by selecting Settings from the app’s menu in the Maker Portal (https://make.powerapps.com/) and toggling the Auto assign per app passes option.
You’ll still need to share the Canvas App with the user.
See: Set up apps to use per app plans
Model-driven apps currently have no way of configuring assigning App Passes, Microsoft will add this in the future. App Passes is simply always enabled for all Model-driven and Portal apps.
For access to a Model-driven app, users will need at least 1 Security Role that gives them access to that app.
Associate a Security Role with a Model-driven app through the Advanced settings > My Apps, select the […] on the app’s tile and select Manage Roles then assign at least 1 Security Role.
Portals currently have no way of configuring assigning App Passes, Microsoft will add this in the future. App Passes is simply always enabled for all Model-driven and Portal apps.
For access to a Portal app, you will have to enable Azure AD sign in for the Portal (enabled by default) and ask your users to use the Azure AD button to sign in on the portal.
After they’ve signed in for the first time a Contact record will be created, you’ll have to assign the appropriate Web Roles to that user using the Portal Management app.
Note from Microsoft:
For the time being, “Ad-hoc subscription” consent plans must be enabled for an organization’s tenant. An ad-hoc subscription refers to trial licenses that can be assigned by admins to users via Azure Active Directory (Azure AD) or the Microsoft 365 admin portal, or that users can sign themselves up for via https://signup.microsoft.com. End users that receive a per app plan also receive an “ad-hoc” Power Apps baseline access plan. This plan ensures users can launch apps shared with them when they’re expected to be entitled access via a per app plan. The requirement for ad-hoc subscription consent plans will be removed in the future. This documentation outlines how ad-hoc subscription consent plans are blocked and unblocked for an organization.