Use a Microsoft Entra service principal to authenticate the Power Apps CLI without opening a browser or using a cached user account. This authentication method is useful for continuous integration and continuous delivery (CI/CD) pipelines and other automated processes that publish updates to an existing code app.
To publish an update, the service principal needs access to the target Power Platform environment and edit access to the code app. Environment-level permissions alone don't grant permission to update an existing app. App sharing and service principal authentication are separate features, but sharing the app is a prerequisite for publishing updates as the service principal.
Important
An app maker must share the app with the service principal before the service principal publishes its first update. Sharing is a one-time prerequisite, not part of the recurring publish process. A service principal can't grant itself access.
Prerequisites
A Power Apps code app that you already published
An app maker account that has permission to share the app
A Microsoft Entra service principal that has access to the target Power Platform environment
These service principal values:
- Application (client) ID
- Client secret
- Directory (tenant) ID
- Enterprise Application object ID
Understand the service principal identifiers
Microsoft Entra ID provides several identifiers for an app registration and its service principal. Use the correct identifier for each operation.
| Identifier | Where to find it | How it's used |
|---|---|---|
| Application (client) ID | App registrations | Set the SP_CLIENT_ID environment variable. |
| Directory (tenant) ID | App registrations | Set the SP_TENANT_ID environment variable. |
| Enterprise Application object ID | Enterprise applications | Pass to pa app share --principal. |
Prerequisite: Share the app with the service principal
If the app already has edit access for the service principal, skip this section. Otherwise, complete these steps once from the app maker's computer. Don't include the sharing command in the CI/CD pipeline.
Important
Don't use the Object ID shown in App registrations in the Microsoft Entra admin center, where you find the application (client) ID, directory (tenant) ID, and client secret. Use the Object ID shown in Enterprise applications instead.
Alternatively, if you know the application (client) ID, retrieve the Enterprise Application object ID by using the Azure CLI az ad sp show command:
az ad sp show --id <application-client-id> --query id --output tsv
Sign in as the app maker and share the code app
Don't enable service principal authentication when sharing the app.
Sign in interactively with the app maker account using the pa auth login command:
pa auth login --account <maker-email>
Confirm that the app maker account is active using the pa auth status command:
pa auth status
From the app folder, grant the service principal edit access using the pa app share command:
pa app share --principal <enterprise-application-object-id> --access edit
The edit access level grants the service principal permission to update the app by using the pa app push command.
To grant permission to play the app without updating it, use --access play:
pa app share --principal <enterprise-application-object-id> --access play
Publish updates as the service principal
After the app has edit access for the service principal, use the service principal to publish updates from a CI/CD pipeline or a local computer. Repeat this procedure for each update. You don't need to share the app again unless the service principal's access is removed.
Configure service principal authentication
Set the service principal authentication environment variables in the CI/CD job or terminal session that you use to publish the update. These variables cause the CLI to authenticate as the service principal instead of using a cached interactive account.
$env:PA_CLI_USE_SP_AUTH = "true"
$env:SP_CLIENT_ID = "<application-client-id>"
$env:SP_CLIENT_SECRET = "<client-secret>"
$env:SP_TENANT_ID = "<tenant-id>"
After you set the variables, run the build and publish commands from that terminal session or CI/CD job.
Build and publish the update
Build the app by using the command configured for your project. For example:
npm run build
Publish the compiled app in noninteractive mode using the pa app push command
pa app push --non-interactive
The CLI uses the service principal credentials from the environment variables and doesn't open a browser or use a cached interactive account.
When the command finishes, an exit code of 0 indicates that the update was published. A nonzero exit code indicates that the command failed.