Power Platform Community Forum Thread Details

Hi Community!

Is there an option to enforce users for using one of the two below authentication methods when creating flows with a webhook trigger?

Authentication methods:

1. Any user in my tenant

2. Specific users in my tenant

We have several users wanting to use webhooks for different use-cases, and we want to provide them with the option while ensuring we don't end up with a lot of open-ended URL's.

I can't see the option to configure this on the specific connectors in the data-loss prevention policies. Perhaps some option exist on a tenant level?

Thank you for your help!

Br,

Daniel21

Categories:

Connector development

Using flows

Using connectors

I don’t believe there is currently a tenant-level setting that enforces the authentication mode for HTTP/webhook triggers in Power Automate.

Right now, the maker chooses the authentication option for each flow trigger individually (“Anyone”, “Any user in my tenant”, or “Specific users in my tenant”). DLP policies can control if the connector is allowed, but not which authentication option is selected.

One possible workaround is to run a recurring PowerShell script that checks flows across environments and identifies flows using anonymous access (“Anyone”). The results could then be reviewed by the platform or security team.

This would not block the configuration, but it would help monitor and clean up insecure webhook endpoints.

Hope it helps!