Skip to main content

Give an App to the People Who Will Use It

Goal​

Put a Model-Driven App on the right people's app launcher, and keep it off everybody else's.

Building an app does not give it to anyone. A new app is visible to makers and administrators and to nobody else — which is the only default it is safe to be wrong about. This is the step that hands it over.

Prerequisites​

  • You are signed in with a maker (or platform administrator) role.
  • The app exists (see Create or Edit a Model-Driven App).
  • The roles you want to give it to exist in the tenant (see Create a Role), and the people who should have it hold one of those roles (see Assign a Role to a User).

Steps​

  1. Open Apps from the sidebar and select the app's row.
  2. Select Share. A panel opens at the side of the screen, headed Who can use app.
  3. Tick every role this app is for. The list is the tenant's roles, by the name you gave them.
  4. Look at People who get it underneath. It fills in as you tick, and lists the users who hold one of the chosen roles. This is the check that matters: if it says nobody holds the roles you have chosen, the app is about to be shared with an empty set.
  5. Select Save. The change takes effect on the next request — the people you chose see the app on their launcher the next time they open it, with no sign-out needed.

To take an app back, open the same panel, untick the role and save. The app stops appearing on those users' launchers, and a bookmarked link into it is refused.

Who this actually reaches​

Sharing is done in roles, not in individual names, and the panel names the people so you can see what that comes to. A person gets the app when they hold at least one of the ticked roles.

If your tenant has more users than the panel shows, it says so at the bottom of the list ("Showing 200 of 480 users"). The list is a check on the decision, not the decision itself — the decision is the roles.

"… can already open every app in this environment"​

Some roles hold a grant on everything that opens, rather than on one app. The Maker role does, from the moment an environment is created: a maker who could not open the app they had just built would meet an environment that looks broken on the first click.

When such a role exists, the panel says so in a note rather than showing you a ticked box you cannot untick. That is deliberate — this app's box could not take away a grant that never named this app. To narrow it, go to Security and edit the role's own permissions.

Studio apps are shared the same way​

A Studio app is on the launcher only for the people it is shared with, exactly like a model-driven app. Select it under Studio apps and choose Share; the panel, the roles and the grant (<app logical name>.Open) are the same. A portal app has no Share: the people who read a portal are portal users, not roles.

What happens behind the scenes​

Sharing an app grants the permission <app logical name>.Open to each chosen role, in this environment. It is an ordinary permission, which is the point:

  • It appears on the Security screen beside every other grant, so "what can this role do here" has one answer.
  • It travels in a solution, so an app promoted from Dev to Test can bring its sharing with it rather than being re-shared by hand in every environment.
  • Uninstalling a managed solution reverts its grants rather than deleting whatever is there, so a solution that shared an app takes only its own share back.
  • An administrator's choice sits above any solution's: an import cannot quietly undo what you decided here, and unticking a role a solution shared with leaves a note that says so rather than letting the solution's grant reappear on the next reload.

Deleting an app takes its sharing with it, so the next app to use the same logical name does not inherit whoever was given the last one.

Troubleshooting​

  • The app is not on someone's launcher. — check they hold one of the ticked roles. The People who get it list in the panel answers this directly; if they are not in it, the role assignment is the thing to fix, under Users.
  • "App … has not been shared with you." — the person followed a link into an app that is not shared with them. Share it with a role they hold, or send them somewhere they can reach.
  • This tenant has no roles yet. — create one under Roles first. An app can only be shared with a role, so there is nothing to tick until one exists.
  • Nobody holds the roles you have chosen. — the share will save and reach nobody. Assign the role to the people who need the app, under Users.
  • I unticked a role and the app is still there for them. — they hold another ticked role, or a role with the grant on everything that opens (see above). The note in the panel names the second case.
  • Create or Edit a Model-Driven App.
  • Grant a Role Access to Records.
  • Assign a Role to a User.
  • Create a Role.