Power Apps licensing: shared station sign-in with per-user licenses

Question

Power Apps licensing: shared station sign-in with per-user licenses

Saran 0

Hi everyone,

We are building a Power Apps canvas app (Dataverse) for a shop floor. Each station has one shared screen. Several workers take turns on it, and workers often wait in line for the screen.

When a worker comes to the screen, they tap their card once. The app must recognize who they are, and then they confirm several steps they have finished, so we know who did what and when.

The time between the card tap and the app knowing who the worker is must be very short (our target is about 1 to 2 seconds). A sign-in that takes longer will create a queue at the station.

Every worker will have their own Entra ID account and their own Power Apps license.

Is there a native way to sign a worker in with a card tap only, without a PIN? The smart card (Entra CBA) and QR code methods we found both need a PIN. If a PIN cannot be avoided, which method has the shortest time from tap to signed-in?
Alternative: the station stays signed in with one shared account. The worker taps their card, and the app finds the worker by card ID. The worker does not sign in with their own account. Every worker still has their own Power Apps license. Is this allowed under Power Platform licensing, or does Microsoft count it as one account used by many people?

Any experience or links would help. Thank you.

0 comments

1 answer

Your answer

Answer 1

Unfortunately, AFAIK, there is no native Entra ID method that guarantees a worker can sign in to a Power Apps session using only a card tap, without a PIN, biometric gesture, or other required authentication step. Entra certificate-based authentication and FIDO2 security keys support different authentication configurations, so it is too broad to say that both always require a PIN. The credential type, security configuration, and device determine what interaction is required. A FIDO2 security key may offer a fast authentication experience, but there is no guaranteed sign-in time, and the complete authentication flow can exceed your 1–2-second target. The only reliable way to establish whether an individual sign-in meets that target is to test the actual devices, credentials, browser or Power Apps player, and Conditional Access configuration in your environment.

For your shop-floor scenario, a shared station session with rapid card-based worker identification is the more practical architecture. Keep the station signed in under a dedicated account and use the card reader to identify the worker inside the app. This avoids repeatedly authenticating each worker to Entra ID and is better suited to a high-throughput workflow.

This approach can comply with Power Platform licensing, provided every worker who uses the app is properly licensed for the app and its Dataverse usage. Microsoft’s multiplexing rules prevent shared accounts or intermediary systems from reducing licensing requirements. Individual worker licenses can satisfy those requirements, but the exact position should be confirmed against your licenses and deployment model. A shared session does not make each worker an authenticated Entra ID user, and Dataverse's native Created By and Modified By fields will identify the shared account for operations performed through that account.

One potential implementation is to use a USB RFID or proximity-card reader in keyboard-emulation mode. When a worker taps their card, the reader enters the badge ID into a focused text input and sends Enter. The canvas app looks up that ID in a Dataverse Workers table, sets a CurrentWorker variable, resets the input, and returns focus to it. For example, the input's OnChange property could contain:

Set(
    CurrentWorker,
    LookUp(
        WorkersTable,
        CardID = TextInput_CardReader.Text
    )
);
Reset(TextInput_CardReader);
SetFocus(TextInput_CardReader);

The input shoudl be available to receive the reader's keystrokes - a hidden or unfocusable control will not likely work reliably. Test the reader's Enter behavior and focus handling on the actual station device. A Dataverse lookup may be fast, but a sub-0.5-second response is not guaranteed, so measure the complete tap-to-ready time under realistic network and workload conditions.

When a worker completes a step, store a Dataverse lookup to the worker record, the completed step, and a timestamp generated using a consistent server-side approach where audit accuracy matters. Do not use User().Email to identify the worker, because that function returns the shared station account's identity. Also note that recording a badge ID establishes application-level attribution, not strong authentication: a borrowed or copied card could be used by someone else. If that risk is acceptable for your workflow, the shared-session design offers the most direct route to meeting the 1–2-second target without requiring individual sign-ins for every worker.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin