What it does

A connector is a wrapper around an API that lets an app talk to a service. Adding one to an app creates a connection — a stored credential — and the connector then offers the app either tables of data, actions, or both.

Key facts

• Microsoft's guidance is a maximum of ten connectors per canvas app and no more than twenty connection references. Beyond that you get slower launch times and problems saving the app.
• Standard connectors don't require special licensing. Premium, on-premises and custom connectors require a standalone Power Apps or Power Automate plan — Microsoft defers the detail to the licensing FAQ and licensing guide rather than stating it per connector.
• Tabular connectors page automatically. Bind a gallery and it pulls the first page, then fetches more as the control asks. Action-based connectors don't — you get one page and no automatic continuation.
• Dynamic schema is common on action connectors: the same action can return different columns depending on inputs, the calling user, or configuration. The connector reference marks these with "The outputs of this operation are dynamic."
• Authentication type determines who the data source sees. Microsoft Entra ID and OAuth pass the end user's identity. Implicitly shared connections, such as SQL Server Authentication and Windows Authentication, do not.
• All newly created shared connections have been secured since January 2024. Published apps talk to a connection proxy scoped to that app, which limits the operations to the ones the app uses. Older apps need republishing to get this.
• Windows Authentication through a gateway isn't secure in the same sense — the connector has access to everything those credentials can reach, and the connection is implicitly shared with app users.
• End users see a consent dialog listing the data sources and what the connector can and can't do. Admins can suppress it only for Microsoft connectors that support single sign-on and for Entra ID OAuth custom connectors, on a per-app basis.
• Power Apps doesn't support Microsoft Entra External member identities.

When to use / skip

Standard connectors are the default and you should exhaust them before proposing anything premium, because the licence cost lands on every user of the app rather than on the maker. When premium is genuinely required — SQL Server, anything on-premises, most third-party systems — get that established in the first week, because it changes the commercial shape of the project. Custom connectors are the right answer for a bespoke internal API and the wrong answer for something you could do with an HTTP call inside a flow the app already invokes.

Configuration decisions

• Which connectors are premium and therefore which users need a premium licence, decided before build rather than at UAT.
• The authentication type per data source, since that decides whether back-end security applies per user or not at all.
• Whether an app stays under the ten-connector guideline or whether some calls move into a flow instead.
• Who owns implicitly shared connections, because that identity performs every action for every user.
• Whether the consent dialog is suppressed for approved apps, which is a per-app admin decision, not a connector one.

Gotchas

• Implicitly shared connections are the security conversation nobody has. The app runs as the connection owner, so back-end permissions are irrelevant and every user effectively has that account's access.
• Connections published before January 2024 were genuinely shareable — users could build their own apps on them. Republishing fixes it, and finding all those apps is the hard part.
• The sharing warning for implicitly shared connections still appears even when the connection is secure. It's noise, and people either panic at it or learn to ignore all warnings.
• Action-based connectors not paging catches people who tested with twenty records and shipped against two thousand.
• Server and database names are hidden in network traces but still visible in the consent dialog, and column names aren't hidden at all.

Consultant notes

• Do the premium connector audit in discovery. "Everyone needs a premium licence" discovered in month three is a project-threatening conversation; discovered in week one it's a line in the business case.
• Don't quote licence costs from memory. Point the client at the current Microsoft licensing guide and let procurement price it.
• Check the connector count on any app you inherit. An app with fifteen connectors is usually an app where someone kept adding data sources instead of designing a data model.
• Treat the consent dialog as part of the user experience. Users who see an unexplained permissions prompt on first launch raise tickets, and a two-line note in the rollout comms prevents most of them.

---

Worth revisiting when connector licensing guidance changes, or if the connector-count guidance is updated.