AAD/EntraID with Power Platform and SharePoint Guideance

Overview

Keeping a clean hierarchical Active Directory (AD) is essential to managing permissions and having good governance in the Power Platform. This post outlines the key core concepts of securing your platforms.

Power Platform is managed at three levels:

1. App (model, canvas or power pages),
2. Environment (user needs permissions to the tenant environment)
3. Source (Dataverse, SQL, SharePoint)

AAD/EntraId

Azure Active Directory (AAD) is the backbone of permissions in the Power Platform. Security groups are normally well set up within AD, but when creating a new group, I tend to use "Microsoft 365"groups to handle permissions.

The process is to add users to Groups (Security or Microsoft 365) and then give permissions using the group.  Security groups can be managed dynamically i.e. if you are in a division you automatically belong to a security group. Or Security groups allow for users to be added individually (there is also a bulk upload).

This keeps management simple, as the Microsoft groups and Security groups can be reused to grant various apps and reports permissions.

Tip: You cannot use distribution groups to assign rights to SharePoint or Power Platform.

Mendix tips & thoughts

Mendix Series

1.  Overview of Mendix 

2. Mendix - Part 2 - Diving deeper

3. Extensibility for Mendix Studio 

4. Building a Mendix Widget for the Mendix marketplace (Convert text to Audio using Azure AI)

5. Mendix Tips & Thoughts (this post)

6. Competitors

Mendix Charting/dashboarding options:

• E-Charts (Community supported) are simple and nice,
• Anycharts (very common),

Grafana can be integrated, but I haven't tried it with Mendix.

Power BI can show reports using an iFrame widget.  I like this approach.

Module/Widget Support Note: Check whether libraries are supported by Mendix/Platform or Partner.

Community-supported obviously can be changed by the community. Partner-supported is also an option if you have an agreement with the partner or trust them.

Performance Testing Tool options:

A colleague has used JMeter and feels it was not ideal. 

I'm considering using the Microsoft Playwright Testing service and Playwright testing.

Enterprise Logging/SIEM SaaS integrations supported by Mendix:

1. App Dynamics.
2. Datadog,
3. New Relic,
4. Dynatrace, and
5. Splunk

Watch out for:

Logging

Each system logs to loc files on the local machine; these can be pushed into the Postgres local instance.  This can result in a massive storage load being added for auditing and logging.  

Monitoring

Logs can be shipped out using backup and restored or by calling the REST Open API.

Maintenance

Mendix builds a database per app per environment, so the recommendation is to use at least 3 per app as you need dev, Test, and Prod. Each instance, by default, uses PostgreSQL (you can only use PostgreSQL if you use the Mendix-provided images deployed on AWS).  

Global Variables

Mendix doesn't have a concept of a global variable at the start or per session. You can load lookup data, which is often held centrally in your enterprise. This can get heavy quickly, but you can copy Open API results into the local PostgreSQL database so it only gets local data.  

Costs

With Mendix, the cost can escalate rather quickly. Reduce cost by scaling back to the most minor instance in dev and test, especially post-go-live. Each app has a separate database, so management and connectivity can become hard to control. 

Performance

Number of Controls & Size of each application.

Mendix Series

1.  Overview of Mendix 

2. Mendix - Part 2 - Diving deeper

3. Extensibility for Mendix Studio 

4. Building a Mendix Widget for the Mendix marketplace (Convert text to Audio using Azure AI)

5. Mendix Tips & Thoughts (this post)

6. Competitors

Weird behaviour on App Onstart for collection creating when the 'Delay Load' preview feature is enabled

Problem: We recently had a few canvas apps start behaving strangely where our menu which used a SharePoint list to populate a collection on the App onStart() was not working on all pages with the exception of the Home page.  This only happened to the published applications, in edit and play mode, it worked perfectly.

Initial Hypothesis: Looking at the logs between the "edit and play" and the "Publish" was showing hundreds to transactions saying something along the lines of "text is blank and therefore will be zero".  When I set the start page to a different page and run the "Published " app, the first page works but not the other pages navigation.  Looking at the difference in the logs, it appears that the collection is seen as empty on subsequent page loads only when running in "Published" mode.

Resolution: I don't remember turning the "delay load" feature on, it only showed up on the 22 May 2024 (or at least we noticed it), I merely turn off the feature and all the affected applications started working again.

Thoughts: The behavior bug must have been caused by either upgrade in Canvas App platform version, or the feature being automatically turn on.  If you get an issue, turn off the experimental feature.

MS Build Conference 2024 Online Notes

A slick keynote, but I'm summarising the items i liked from the online sessions I watched:

New SharePoint Options to be aware of

SharePoint Embedded

We have all used SharePoint and the API's but this is really useful as it allows me to have full SharePoint API access to use with my applications.  So it can be protected and scale.  I've had tons of projects that should have used this but instead backed on dedicated Site Collections.

External user on SPO have to be guests, and you use the subscription model, so i think you can have 5 guests for each O365 paid user.  Issue is this is then giving access to your internal SharePoint/collaboration area.  SharePoint Embedded provides a dedicated area and offers two types of consumption/billing models: 

• ISV-led, and
• and direct-to-customer billing.

SharePoint Premium

SharePoint Premium offers advanced features such as AI/copilot...

Power BI Licencing Explained

 Power BI Licencing (Simple Overview)

(Simplified April 2024)

Power BI Free is for individual users who need to create personal reports and dashboards.  Perfect for people that don't need to share and want to analyse data in the business.

Power BI Pro is for individuals that need to share content, collaborate with others, and use all Power BI service features.  Circ $10/user/month.  People building reports and can share amonst other users with the Power BI Pro licence.

Power BI Premium is for large organizations with extensive data needs and a large number of users, including those who do not require full Power BI Pro capabilities.  All the content viewers of the reports and dashboards, don't need any licences.  Circe from $5k per month.  Perfect for 1 user creates a report and multiple users use the report.

Low code CoE thoughts

Key areas to address for a Low Code CoE:

1. Portfolio of Products
2. People/Skills/Experts
3. Process/ALM
4. Platform/Governance/Cleanup/Architecture/NFR's (scalability, SLAs)
5. Promotion/delivery/training

Consider putting the project through a Business case validation, particularly for larger projects.  The business case is how your business visualises and communicates a proposed project, which should continuously be refined.  Points to cover:

1. Business Case (Idea)
2. Customer Segment >
3. Value Proposition (what do they get) > 
4. Channels (API, website, AI Services, .. ) Customer Achievement (get and retain) >
5. Revenue (how to make money)
6. Key Resources (patches, maintenance) covers technology and data.  What tech, people need to build and continue delivering.  Data: where does it come from, quality, restrictions, relevancy.
7. Partners (dependency e.g. AWS, Azure, Mendix, OutSystems, UiPath, Microsoft, and backup options)
8. Cost breakdown

CoE needs to clearly understand its boundaries and responsibilities.  

I am a big fan of Total Ownership, clear requirements and goals, using RACI, and stand-ups. For the rest, I try to be agile and malleable. Big projects require more oversight and planning, so I allow teams to change and focus on delivery.