Conditional Access for Canvas Apps with Entra

In today's Power Platform landscape, administrators have a tough task securing the ever-increasing inventory of Canvas Apps across their tenant. Canvas apps often connect to sensitive data, run on a variety of devices, and serve diverse groups of users. That is why Conditional Access has become one of the most powerful tools in an admin’s toolkit, giving you fine grained control over how, where, and under what conditions users can access your apps. 

  

In this post, I will walk through what Conditional Access means for canvas apps, how it empowers admins to maintain strong security without adding friction for legitimate users, and example steps to apply your own conditional access policies to an app with PowerShell. 

  

What Conditional Access Brings to Canvas Apps 

Conditional Access brings granular, app-level security controls from Microsoft Entra ID directly into Power Apps. Instead of applying blanket restrictions across the entire tenant, you can enforce requirements—like MFA, compliant devices, or trusted networks—only on the apps that need them. 

This lets you match security to the sensitivity of each individual app. 

  

Key Benefits for Admins 

1. Tailored Protection for Sensitive Apps

Not every app requires strict controls. Conditional Access allows you to tighten security only for apps that handle sensitive or regulated data, without over restricting everything else. 

2. Control Access by Device Type

Admins can easily block or allow specific device categories—like preventing mobile access to a high-risk app or requiring managed devices for apps that contain confidential information. 

3. Alignment With Zero Trust

Conditional Access enforces identity, device, and session checks in real time, supporting a Zero Trust approach without adding unnecessary friction for legitimate users. 

4. Environment-Specific Flexibility 

You can apply stricter policies in production and lighter ones in development or testing, helping teams build efficiently while keeping sensitive environments locked down. 

  

A Stronger Security Model 

Conditional Access does not replace existing apps or data permissions—it complements them. App-level security roles control what users can do inside an app, while Conditional Access governs whether they can get into the app at all. Together, they create a much more robust security posture. 

  

How to enable conditional access for a Canvas App example 

In this example, I will detail steps to set up conditional access for a Canvas App to ensure tenant guest users are not able to access the app. 

  

Step 1: Create an Authentication Context in Entra ID 

1. Go to the Microsoft Entra Admin Center. 
2. Navigate to Protection → Conditional Access → Authentication context. 
3. Click + New authentication context. 

• Name it (e.g., BlockGuests_PowerAppX) 

• Enable Publish to apps 

• Save and note the Authentication Context ID 

  

 

 

 

  

  

Step 2: Create a Conditional Access Policy 

1. Go to Conditional Access → Policies → + New policy. 
2. Name the policy (e.g., Block Guests from Power App X). 

Assignments: 

• Users or workload identities:   

• • Include: Guest or external users 

• Target resources: 

• • Choose Authentication context 

• • Select the one you created earlier 

Access controls: 

• Grant: Select Block access 

1. Enable the policy and click Create. 

  

 

 

 

  

Step 3: Assign the Authentication Context to the Power App 

Use PowerShell to bind the Authentication Context to the specific Power App: 

1. Open PowerShell as Administrator. 
2. Connect to Power Apps 

Add-PowerAppsAccount

1. Run the command to attach the context to your canvas app 

Set-AdminPowerAppConditionalAccessAuthenticationContextIds 

-EnvironmentName "<your-environment-name>" ` 

-AppName "<your-app-id>" ` 

-AuthenticationContextIds "<your-auth-context-id>" 

  

 

 

 

This binding tells Power Apps: “When this app opens, trigger the Conditional Access policy tied to this context.” 

  

Step 4: Test the Policy 

• Try accessing the app as a guest user. 

• You should see access blocked based on the Conditional Access policy. 

 

 

 

  

  

  

  

Wrap Up 

A Stronger Security Model 

Conditional Access does not replace existing apps or data permissions—it complements them. App-level security roles control what users can do inside an app, while Conditional Access governs whether they can get into the app at all. Together, they create a much more robust security posture. 

Bottom Line 

Conditional Access gives admins the flexibility to apply the right security to the right app. Whether you are enforcing MFA, restricting device types, or securing production environments, it helps you protect sensitive data without slowing down the organization. 

 

Documentation for further reading: Manage Power Apps - Power Platform | Microsoft Learn 

Demo from Power CAT: Conditional Access Policies for Canvas Apps - Power CAT Live