Infrastructure
Available on the Apple store and Google play store, Powell apps authenticate users through tenant sign-on infrastructure (Microsoft only or SSO provider)​
Application configuration is requested to Powell API servers after authentication
Frameworks and libraries
| Component name | Version | License | Description |
| AathifMahir.Maui.MauiIcons.FontAwesome | 6.0.0 | MIT | FontAwesome icon pack for .NET MAUI. |
| AutoMapper | 16.2.0 | Commercial | Object-to-object mapper (DTOs, models…). |
| CommunityToolkit.Maui | 15.0.1 | MIT | UI components, helpers, and extensions for .NET MAUI (also provides popups and badge). |
| CommunityToolkit.Mvvm | 8.4.2 | MIT | Official MVVM Toolkit (INotifyPropertyChanged, RelayCommand…). |
| Flurl.Http | 4.0.2 | MIT | Fluent HTTP client with URL chaining. |
| HorusStudio.Maui.Skeleton | 3.0.0 | MIT | Skeleton loading placeholders for MAUI views. |
| JWT | 11.1.0 | CC0-1.0 | Open standard (RFC 7519) that defines a compact token format. |
| Microsoft.Extensions.Configuration.Binder | 10.0.12 | MIT | Binds configuration sections to strongly-typed objects. |
| Microsoft.Extensions.Configuration.Json | 10.0.12 | MIT | JSON configuration provider (appsettings.json). |
| Microsoft.Extensions.Logging.ApplicationInsights | 2.23.0 | MIT | Logging provider that ships telemetry to Application Insights. |
| Microsoft.Identity.Client | 4.89.0 | MIT | MSAL — Azure AD sign-in and silent token refresh. |
| Microsoft.Identity.Client.Extensions.Msal | 4.89.0 | MIT | MSAL token-cache persistence extensions. |
| Microsoft.Maui.Controls | 10.0.101 | MIT | Main UI framework for .NET MAUI Controls. |
| Microsoft.Maui.Controls.Compatibility | 10.0.101 | MIT | Compatibility layer, referenced explicitly to stay in lockstep with Controls. |
| MonkeyCache.FileStore | 3.0.0-beta | MIT | FileStore backend for MonkeyCache (local key/value caching). |
| Newtonsoft.Json | 13.0.4 | MIT | Popular JSON library for serialization/deserialization. |
| Plugin.TabbedPage.Maui | 1.2.8 | MIT | Plugin that enhances TabbedPage behavior in MAUI. |
| Polly | 8.8.0 | BSD-3-Clause | Resilience library: retry, circuit-breaker, timeout, fallback… |
| Prism.DryIoc.Maui | 9.0.537 | Prism Community | MVVM framework with navigation + DI (DryIoc) for MAUI. |
Authentication
App consent ​
Powell apps has to be authorized over Azure Active Directory.
- A consent link is available on Powell Manager for administrators​
- Consent has to be done before app deployment
Authentication​
Powell Apps only requires only one successful authentication ​
- Authentication is stored until the user logout ​
- The app can be closed and reopened without user authentication​
- Microsoft authentication settings supported (MFA, Microsoft Authenticator)
MSAL.NET Integration
Powell Apps uses MSAL.NET to manage authentication and token refresh securely.
Tokens are cached to allow silent reconnection without prompting the user.
MSAL.NET handles silent renewal and Microsoft identity flows for a seamless login experience.
It is also used to obtain the necessary tokens for Microsoft Graph API access after admin consent.
Single Sign-On (SSO)
​SSO shares centralized authentication servers that all other applications and systems use for authentication​
- Powell Apps supports SSO providers connected to the Microsoft authentication process (eg: Okta, OneLogin…)​
- The same user experience has standard Microsoft authentication
Graph API access
​App consent grants access to several user information from Microsoft Graph API​
- If Powell Apps requests are forbidden, UI will be adapted to hide objects linked to forbid data
Conditional Access Policy
Our application integrates a Webview (embedded browser) to display your intranet pages, but unfortunately, this component does not support device compliance-related conditional access rules.
But you can exclude the following apps from your rule to avoid this limitation:
- "Office365" => Authentication form
- "Powell365 - Mobile App"
- "Powell-GraphAPI" or "Powell Intranet"
Permissions by feature
Each app feature only activates if the corresponding Graph/SharePoint permission has been consented to at the tenant level. If a permission is denied, the UI hides the objects tied to that data.
| Feature | Required permission | Justification |
|---|---|---|
| Authentication / session | openid, offline_access, User.Read | SSO login and session persistence without reprompting |
| Org chart | User.Read.All | Reads jobTitle, department, officeLocation, mobilePhone, businessPhones, manager |
| Directory / people search | People.Read.All | Contact suggestions and relevant-people search |
| Calendar | Calendars.ReadWrite | Reading and creating events |
| Intranet: pages and files | Sites.Read.All, Files.Read.All | Reading SharePoint pages and documents |
| Intranet: lists (create/update) | AllSites.Write | Covers item-level operations (the recycle call is a POST carrying an X-HTTP-Method: DELETE header, so it's item-level, not list-level) |
| Intranet: list/file reads, effective permissions | AllSites.Read | Required for EffectiveBasePermissions and item/file reads |
| Metadata / taxonomy | TermStore.Read.All | Resolving managed metadata terms |
| Flexdesk: Office/room location | Place.Read.All | Room and space data for location/booking features |