The Secret Admin Toolkit: Overlooked PowerShell Commands for Power Apps

Every Power Apps admin eventually hits a wall: the admin centre simply doesn’t expose certain settings, recovery workflows, or bulk operations. That’s when PowerShell becomes your escape hatch. In this guide, we’ll walk through eight cmdlets that cover disaster recovery, licensing control, tenant-wide restrictions, and mobile app presentation. The examples follow a fictional admin, Jordan, who manages Fabrikam’s Power Apps estate.

Why PowerShell for Power Apps?

The Power Platform admin centre is great for daily user interface tasks, but many actions—like changing an app’s owner, bypassing consent prompts, or associating a flow with an app—are only possible through the PowerShell module. These cmdlets also let you automate repetitive tasks across hundreds of apps.

Prerequisites

Before you start, install the Microsoft.PowerApps.Administration.PowerShell module and sign in with a tenant administrator account.

powershellInstall module and connect

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Force -AllowClobber
Add-PowerAppsAccount

Scenario: Jordan at Fabrikam

Jordan is the Power Platform admin at Fabrikam, a company with 20+ canvas apps and hundreds of users. Recently Jordan faced:

A deleted app that no one can restore from the recycle bin.
An app whose owner left the company.
A nuisance feedback survey popping up for every app.
A request to “feature” an app in the mobile client.
A need to connect a premium flow to an app to save licensing costs.
Management wanting to block users from signing up for trial licenses.
A compliance concern about apps shared accidentally with “Everyone”.

The cmdlets below solved every one of these problems.

1. Disable the In-App Feedback Survey

The survey dialog appears at random times and confuses users. Jordan turned it off tenant-wide by modifying the tenant settings.

powershellStop the feedback survey

$settings = Get-TenantSettings
$settings.powerPlatform.powerApps.disableSurveyFeedback = $true
Set-TenantSettings -RequestBody $settings

This change is immediate and applies to all existing and future apps. No restart required.

2. Recover a Deleted Canvas App

An intern accidentally deleted the main sales tracking app. Jordan used the recycle bin cmdlet to restore it within the 7‑day window.

powershellList and recover deleted apps

$envFabrikam = "Fabrikam-Production"
$deletedApps = Get-AdminDeletedPowerAppsList -EnvironmentName $envFabrikam
$deletedApps | Format-Table AppName, AppId, DeletedTime

Once Jordan identified the app ID (aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee), recovery was one line:

powershellRestore the app

Restore-AdminDeletedPowerApp -AppName "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" -EnvironmentName "Fabrikam-Production"

Only apps deleted within the last 7 days are visible. After that, the cmdlet returns nothing.

3. Transfer Ownership of a Canvas App

The sales app’s owner left Fabrikam, but the app is mission‑critical. Jordan assigned ownership to another user.

powershellChange app owner

Set-AdminPowerAppOwner -AppName "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" 
  -EnvironmentName "Fabrikam-Production"

The new owner immediately gains full edit permissions, while the previous owner’s access is removed.

When users open an app for the first time, Power Apps asks for permission to connect to connectors (SharePoint, SQL, etc.). For internal apps with standard scopes, this dialog is unnecessary friction. Jordan suppressed it for the expense report app.

powershellBypass consent for one app

Set-AdminPowerAppApisToBypassConsent -EnvironmentName "Fabrikam-Production" `
  -AppName "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

Keep consent visible for sensitive apps

Bypassing consent removes the prompt entirely. Only do this for apps that use trusted connectors and where users have already accepted the terms organisation‑wide.

5. Pin a Featured and Hero App in Power Apps Mobile

Fabrikam launched a new onboarding app and wanted it front‑and‑centre on employees’ phones. Jordan first set it as a featured app, then promoted it to Hero (the single top app on the home screen).

powershellSet app as featured and hero

# Make it a featured app (can have multiple)
Set-AdminPowerAppAsFeatured -AppName "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

# Promote to Hero (only one per tenant)
Set-AdminPowerAppAsHero -AppName "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

Changing the Hero app automatically demotes the previous hero to a regular featured app.

6. Associate a Flow to an App to Reduce Licensing Cost

Fabrikam has a premium flow that sends approval emails. By associating it with a premium app, the app user’s license covers the flow execution. Jordan linked them in the same environment.

powershellAssociate a flow to an app

Add-AdminFlowPowerAppContext -EnvironmentName "Fabrikam-Production" `
  -FlowName "flow-1111-2222-3333" `
  -AppName "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

Licensing rules

Microsoft’s terms state that the flow and app must logically belong together (e.g., part of the same solution). Associating a flow only to avoid a per‑user license otherwise is prohibited.

7. Generate a Per‑App License Usage Report

The admin centre doesn’t show which users are consuming per‑app licenses. Jordan exported a CSV to audit license usage.

powershellExport per‑app licenses to CSV

Get-AdminPowerAppLicenses -OutputFilePath "C:\Reports\FabrikamLicenses.csv"

The CSV lists each user, the app they accessed, and the license plan used.

8. Block Users from Requesting Trial Licenses

To enforce proper license procurement through IT, Jordan disabled self‑service trial sign‑ups. This requires also disabling AllowAdHocSubscriptions in Azure AD.

powershellRemove user trial consent plans

Remove-AllowedConsentPlans -Types "Internal"

This action is irreversible from the PowerShell side. If you later need to re‑enable it, you must use the Azure AD portal to turn on AllowAdHocSubscriptions again.

Security & Performance Notes

Module permissions: Only Global Admins, Power Platform Admins, or Dynamics 365 Admins can run these cmdlets.
Bulk operations: When running cmdlets like Set-AdminPowerAppOwner across many apps, always use -EnvironmentName to scope the call. Unscoped calls may affect every environment.
Avoid runbooks: Most of these cmdlets are synchronous and long‑running. Don’t put them inside automation runbooks that expect immediate responses.
Delegation: PowerShell does not delegate model‑driven app queries. For large environments, use filtering parameters (e.g., -AppName) to limit results.

Common Mistakes & Troubleshooting

Mistake	Symptom	Fix
Using a non‑admin account	`Access denied` errors	Sign in with a user who has the Power Platform Admin role.
Wrong module version	Cmdlet not recognised	Update the module: `Update-Module Microsoft.PowerApps.Administration.PowerShell`
Environment name typo	`Environment with name ... not found`	Use `Get-AdminPowerAppEnvironment` to list valid names.
Recovering an app older than 7 days	`Get-AdminDeletedPowerAppsList` returns nothing	The app is permanently lost unless you have a backup solution.
Changing owner without environment scope	`Set-AdminPowerAppOwner` fails	Always supply both `-EnvironmentName` and `-AppName`.

Final Recommendation

PowerShell for Power Apps is a safety net, not a daily driver. Start by automating one or two of the tasks above in a non‑production environment, then gradually expand your script library. Always keep a copy of your tenant settings before modifying them (use Get-TenantSettings | Export-CliXml)—it makes recovery simple if something goes wrong.

References

Original article by Matthew Devaney: 10 Useful Power Apps PowerShell Cmdlets
Microsoft Learn: Get started with Power Apps admin PowerShell cmdlets
Microsoft Learn: Manage Power Apps licenses with PowerShell
Microsoft Learn: Associate a flow to an app