Infrastructure
Available on the Apple store and Google play store, Powell apps authenticate users through tenant sign-on infrastructure (Microsoft only or SSO provider)​
Application configuration is requested to Powell API servers after authentication
Frameworks and libraries
| Component name | Version | License | Description |
|---|---|---|---|
| AathifMahir.Maui.MauiIcons.FontAwesome | 4.0.0 | MIT | FontAwesome icon pack for .NET MAUI. |
| AutoMapper | 15.1.3 | MIT | Object-to-object mapper (DTOs, models…). |
| CommunityToolkit.Maui | 9.1.1 | MIT | UI components, helpers, and extensions for .NET MAUI. |
| CommunityToolkit.Mvvm | 8.4.0 | MIT | Official MVVM Toolkit (INotifyPropertyChanged, RelayCommand…). |
| Flurl.Http | 4.0.2 | MIT | Fluent HTTP client with URL chaining. |
| Flurl.Http.Newtonsoft | 0.9.1 | MIT | Flurl integration with Newtonsoft.Json. |
| Microsoft.Extensions.Logging.Debug | 9.0.10 | MIT | Logging provider that outputs to Debug. |
| Microsoft.Maui.Controls | 9.0.90 | MIT | Main UI framework for .NET MAUI Controls. |
| MonkeyCache | 3.0.0-beta | MIT | Simple local key/value caching library. |
| MonkeyCache.FileStore | 3.0.0-beta | MIT | FileStore backend for MonkeyCache. |
| Newtonsoft.Json | 13.0.4 | MIT | Popular JSON library for serialization/deserialization. |
| Plugin.TabbedPage.Maui | 1.2.8 | MIT | Plugin that enhances TabbedPage behavior in MAUI. |
| Polly | 8.6.4 | BSD-3-Clause | Resilience library : retry, circuit-breaker, timeout, fallback… |
| JWT | 11.0.0 | MIT | Open standard (RFC 7519) that defines a compact. |
| Prism.DryIoc.Maui | 9.0.537 | MIT | MVVM framework with navigation + DI (DryIoc) for MAUI. |
| RGPopup.Maui | 1.2.2 | MIT | Popup component for .NET MAUI. |
| System.IdentityModel.Tokens.Jwt | 8.13.0 | MIT | JWT token creation, parsing, and validation. |
| Xamarin.AndroidX.Activity.Ktx | 1.10.1.2 | Apache 2.0 | Kotlin extensions for AndroidX Activity APIs. |
| Xamarin.AndroidX.Fragment.Ktx | 1.8.8 | Apache 2.0 | Kotlin extensions for AndroidX Fragment APIs. |
| Xamarin.AndroidX.SavedState | 1.3.0.1 | Apache 2.0 | AndroidX SavedState API for state persistence. |
| Xamarin.Firebase.Messaging | 124.1.2 | Apache 2.0 | Firebase Cloud Messaging integration for Android. |
| Xamarin.GooglePlayServices.Base | 118.7.2 | Apache 2.0 | Core Google Play Services dependency. |
| Xamarin.ShortcutBadger | 1.1.22.80 | Apache 2.0 | Badge counter management for Android app icons. |
Authentication
App consent ​
Powell apps has to be authorized over Azure Active Directory.
- A consent link is available on Powell Manager for administrators​
- Consent has to be done before app deployment
Authentication​
Powell Apps only requires only one successful authentication ​
- Authentication is stored until the user logout ​
- The app can be closed and reopened without user authentication​
- Microsoft authentication settings supported (MFA, Microsoft Authenticator)
MSAL.NET Integration
Powell Apps uses MSAL.NET to manage authentication and token refresh securely.
Tokens are cached to allow silent reconnection without prompting the user.
MSAL.NET handles silent renewal and Microsoft identity flows for a seamless login experience.
It is also used to obtain the necessary tokens for Microsoft Graph API access after admin consent.
Single Sign-On (SSO)
​SSO shares centralized authentication servers that all other applications and systems use for authentication​
- Powell Apps supports SSO providers connected to the Microsoft authentication process (eg: Okta, OneLogin…)​
- The same user experience has standard Microsoft authentication
Graph API access
​App consent grants access to several user information from Microsoft Graph API​
- If Powell Apps requests are forbidden, UI will be adapted to hide objects linked to forbid data
Conditional Access Policy
Our application integrates a Webview (embedded browser) to display your intranet pages, but unfortunately, this component does not support device compliance-related conditional access rules.
But you can exclude the following apps from your rule to avoid this limitation:
- "Office365" => Authentication form
- "Powell365 - Mobile App"
- "Powell-GraphAPI" or "Powell Intranet"
Permissions by feature
Each app feature only activates if the corresponding Graph/SharePoint permission has been consented to at the tenant level. If a permission is denied, the UI hides the objects tied to that data.
| Feature | Required permission | Justification |
|---|---|---|
| Authentication / session | openid, offline_access, User.Read | SSO login and session persistence without reprompting |
| Org chart | User.Read.All | Reads jobTitle, department, officeLocation, mobilePhone, businessPhones, manager |
| Directory / people search | People.Read.All | Contact suggestions and relevant-people search |
| Calendar | Calendars.ReadWrite | Reading and creating events |
| Intranet: pages and files | Sites.Read.All, Files.Read.All | Reading SharePoint pages and documents |
| Intranet: lists (create/update) | AllSites.Write | Covers item-level operations (the recycle call is a POST carrying an X-HTTP-Method: DELETE header, so it's item-level, not list-level) |
| Intranet: list/file reads, effective permissions | AllSites.Read | Required for EffectiveBasePermissions and item/file reads |
| Metadata / taxonomy | TermStore.Read.All | Resolving managed metadata terms |
| Flexdesk: Office/room location | Place.Read.All | Room and space data for location/booking features |