Link to a Power App from Send an Email (V2): Safe Deep Links

Yes—you can put a clickable link to a canvas app in Power Automate’s Send an email (V2) action, and you can pass a record ID so the app opens the right screen.

The reliable pattern is:

1. copy the published app’s Web link from Power Apps;
2. append a URL-encoded parameter such as recordId;
3. read it in the app with Param("recordId");
4. use App.StartScreen to choose the first screen;
5. validate and convert the parameter before looking up the record;
6. insert the resulting URL into the email as a normal hyperlink;
7. share the app and its data separately with every recipient.

A deep link is navigation, not authorization. Someone who receives the email still needs permission to run the app and access the underlying data.

The complete design

Assume a SharePoint list named Support Tickets and a canvas app with scrHome and scrTicket. The flow runs when a ticket is created and emails a link containing that list item’s numeric ID.

Layer	Responsibility
Power Apps Web link	Opens the published app in the correct environment and tenant
Query parameter	Carries a small identifier such as recordId=452
App.StartScreen	Chooses scrTicket when the parameter exists
Record formula	Converts and looks up the ID safely
Send an email (V2)	Delivers the hyperlink and readable context
App/data sharing	Decides whether the recipient is authorized

1. Copy the published Web link

In Power Apps:

1. select the correct environment;
2. open Apps;
3. select the app and open Details;
4. copy Web link;
5. store that value in a clearly named flow variable, environment variable or configuration record.

Microsoft’s Launch and Param documentation recommends copying the Web link from the app details. Current links can include the environment, app and tenant query string. Copying the issued link is safer than hand-building a URL from fragments.

Publish the app version that understands the parameter before sending production links to it.

2. Append an encoded record parameter in the flow

If the copied Web link already contains ?tenantId=..., append another parameter with &, not a second ?.

Create a Compose action named Compose - App link. Its expression can be:

concat(
  variables('AppWebLink'),
  '&recordId=',
  uriComponent(string(triggerBody()?['ID']))
)

uriComponent() converts characters to a URI-safe representation. Microsoft’s workflow expression reference applies to Power Automate as well as Azure Logic Apps.

For a numeric SharePoint item ID, encoding is simple but still keeps the pattern safe and reusable. For text business keys, it is essential.

Do not place secrets, personal data or permission claims in the query string. URLs can appear in browser history, email security systems and logs. Pass an opaque identifier and enforce access in the app and data source.

3. Route with App.StartScreen

Set the canvas app’s StartScreen property to:

If(
    !IsBlank(Param("recordId")),
    scrTicket,
    scrHome
)

Microsoft’s canvas-app deep-link guide demonstrates Param() and StartScreen for this purpose.

Keep StartScreen declarative. Do not depend on variables created by App.OnStart; Microsoft notes that StartScreen cannot depend on global variables or collections that OnStart creates.

4. Validate and load a SharePoint record

URL parameters arrive as text. A SharePoint list item ID is numeric, so validate it before using Value().

For scrTicket.OnVisible:

With(
    { rawRecordId: Param("recordId") },
    If(
        IsBlank(rawRecordId) || !IsNumeric(rawRecordId),
        Set(varTicket, Blank());
        Notify("This ticket link is not valid.", NotificationType.Error),
        Set(
            varTicket,
            LookUp(
                'Support Tickets',
                ID = Value(rawRecordId)
            )
        );
        If(
            IsBlank(varTicket),
            Notify(
                "The ticket was not found or you do not have access.",
                NotificationType.Error
            )
        )
    )
)

Set the form’s Item property to varTicket.

Avoid telling the user whether an unauthorized record definitely exists. Not found or you do not have access does not leak that distinction.

For Dataverse, the primary key is normally a GUID rather than a SharePoint integer. Validate the text before converting it, then use the table’s actual primary-key column. The conversion shape is:

GUID(Param("recordId"))

Do not copy a SharePoint Value() example into a Dataverse app or a GUID example into a SharePoint lookup.

5. Put the link in Send an email (V2)

Add Office 365 Outlook’s Send an email (V2) action. Put useful context in the subject and body so the message remains understandable even when a mail client rewrites the link.

In the rich-text editor, add normal display text such as Open ticket in Power Apps, select it, and use the link control. Insert the output from Compose - App link as the URL.

If you use the action’s HTML view, the conceptual result is:

<p>A support ticket is ready for review.</p>
<p><a href="APP_LINK_OUTPUT">Open ticket in Power Apps</a></p>

Use the dynamic output token in place of APP_LINK_OUTPUT; do not type a pseudo-expression such as @{triggerOutputs()?} without the required property path. The designer should own the token.

Keep the HTML simple. Outlook desktop, Outlook on the web, Outlook mobile and security link-rewriting products do not render every email feature identically.

6. Share the app and data with the recipients

Before launch, use Microsoft’s canvas-app resource-sharing checklist and verify each recipient has:

• permission to run the canvas app;
• the appropriate Power Apps licence for every connector it uses;
• permission to the SharePoint list, Dataverse table or other data source;
• access to any flows, gateways or custom connectors the app requires;
• an identity supported by the app’s sharing model.

Canvas apps can be shared with appropriately configured guest users; Microsoft documents canvas-app guest access. Do not claim that every external recipient must use Power Pages, and do not assume every emailed external address can run the app. Validate the guest, licence, connector and data-source boundaries for your design.

Use environment-aware configuration

Do not hard-code a development app URL into a production flow. Keep the Web link in an environment variable or another governed configuration location and give each environment its own value.

Your release sequence should be:

1. import or update the solution;
2. set the environment’s app Web link;
3. publish the app;
4. turn on the flow;
5. send a test message to a non-maker;
6. verify the record and permission boundary;
7. retain a rollback version.

Test more than “the link is blue”

Test:

• no recordId parameter: app opens scrHome;
• valid SharePoint ID: correct ticket opens;
• nonnumeric ID: clear invalid-link message;
• missing/deleted record: no blank form that looks editable;
• unauthorized record: no data leak;
• unpublished app change: old version does not receive production traffic;
• recipient without app access: expected access request or denial;
• Outlook desktop, web and mobile clients used by your audience;
• links rewritten by your mail-security product;
• development and production environment values.

Also test an app that is already open. Query parameters are read when the app launches, so browser and mobile reuse behaviour can differ. Use Microsoft’s separate mobile deep-link guidance if the requirement is specifically to force the Power Apps mobile app.

Common mistakes

• Constructing an outdated apps.powerapps.com URL instead of copying the Web link.
• Adding ?recordId= when the Web link already contains a query string.
• Failing to encode a text parameter.
• Treating Param() text as a number or GUID without validation.
• Using imperative Navigate() in App.OnStart when StartScreen is the supported routing property.
• Embedding a malformed trigger expression in raw HTML.
• Assuming the link grants app or data access.
• Putting personal or sensitive data in the URL.
• Testing only as the maker.

Frequently asked questions

Can Send an email (V2) include a link to a Power App?

Yes. Insert the published app’s Web link as a normal hyperlink. For a record-specific link, append an encoded query parameter and read it with Param().

Should I build the Power Apps URL myself?

Prefer the Web link from the app’s Details page. It reflects the app, environment and tenant format Microsoft currently issues and is safer than copying an old URL template.

How do I open a specific SharePoint list item?

Pass the item ID as text, validate it with IsNumeric(), convert it with Value(), and use a delegable LookUp on the SharePoint ID column.

Does the email link give the recipient permission?

No. App sharing, licensing and data-source permissions are separate. A deep link only tells an authorized app which context to open.

Why does the app open the home screen instead?

Check the delivered URL, parameter name and encoding; confirm the published app version uses the same Param() name in StartScreen; and test whether an already-open player session needs to be relaunched.

For more reliable Power Automate and Power Apps hand-offs, join the Power Automate Mastery Space. Bring a redacted Web link shape, the parameter type and the delivered email result.