What's the impact if we turn on 2fa on an account used in flows.

(3) Share

Report

Posted on by muhammadhassan

Microsoft is enforcing us to enable 2 factor authentication on tenant level. What's the impact if we turn on 2fa on an account used in flows. Will the current connection fail? If it fails, how can we resolve and make sure it works fine in future.

Categories:

Using flows

email image.png

I have the same question (0)

All responses (6)

Answers (0)

Suggested answer

trice602 15,404 Super User 2025 Season 2 on at

Like (1)

Report

Hi,

For your service account that is running unattended flows, you will want to apply for your organizations except policy described in the email. That's because when you run unattended desktop flows, you can't use MFA. These exceptions are typically always approved by I/T in my experiences.

If you are using CyberArk you may also investigate that process which may help with your MFA policies.

------------------------------------------------

⭐ If this was helpful, please like and/or mark as a verified answer to help others find this too!

Always glad to help! 💯💯💯💯💯

Tom

Follow me on LinkedIn - Thomas Rice, PMP | LinkedIn

Was this reply helpful? Yes No
muhammadhassan 8 on at

Like (1)

Report

I'm talking about cloud flow not desktop flow.

Was this reply helpful? Yes No
David_MA 12,982 Super User 2025 Season 2 on at

Like (1)

Report

I would suspect that enabling Multi-Factor Authentication (MFA) on an account that has workflows in Power Automate would potentially disrupt the connection references. When MFA is enabled, it may require re-authentication for the connections used in your workflows, which could cause them to fail until the connections are updated to comply with the new authentication requirements.

Was this reply helpful? Yes No
trice602 15,404 Super User 2025 Season 2 on at

Like (0)

Report

Hey there!

I am following up on this post what's the impact if we turn on 2fa on an account used in flows. in this category using flows from 08/19/2024. I know the post is a little older, but it is a common question here so wanted to take a moment and follow-up. I see there have been 3 replies and 3 likes and asking if your question has been answered. If so, please help the community out by completing one or more of the following actions! Thanks in advance!

Easy as 1-2-3 ‼️💯⭐😎🆒🙏

1) Mark a reply as a verified answer - this is essential, and it helps others with the same general question find this thread. ✅

2) You can also mark one of more replies as a verified answer. Please take a moment and give the author credit for volunteering their time. ✌️

3) Like one or more replies. Kudos always greatly appreciated! 👍

Pro tip: if you found your own solution or workaround, feel free to add a reply to your own post and mark it as the solution too! The goal is to get this thread marked with a verified answer by anyone that finds one or more replies helpful!

Again, thanks in advance for reading and responding, always glad to help! Tom 💯💯💯💯💯

Was this reply helpful? Yes No
trice602 15,404 Super User 2025 Season 2 on at

Like (0)

Report

If I can help with anything else please let me know or tag me in a future post, I enjoy reading and answering questions. Always glad to help! Tom 💯💯💯💯💯

Was this reply helpful? Yes No
Brice235i 651 on at

Like (0)

Report

This is a significant issue. In our organisation, the security token timeout is set to 90 days. We have thousands of flows with service accounts connected to Azure Portal indirect touchpoints, such as Entra, Azure Key Vault, and anything involving Graph. Every 90 days, the person whose mobile phone is associated with a particular service account will need to refresh the connections. This poses a substantial risk to operations if the service account token is not refreshed in time. Although Microsoft recommends using Service Principals, not all connectors support it, such as SharePoint and Outlook. We are looking at extending security token lifetimes to try to reduce the impact.

Was this reply helpful? Yes No