How to scale a flow with Graph API /me/ endpoints to multiple users without cloning flows?

(1) Share

Report

Posted on by MD35981

I've built a Power Automate scheduled cloud flow that generates a daily AI-powered email summary for a Tax partner at our firm. The flow runs at 5 PM ET and does the following:

Calls Microsoft Graph API via the "Send an HTTP request" (Microsoft Graph connector) to retrieve the user's inbox emails, sent emails, and calendar events using /me/ endpoints

Passes the data through AI Builder prompts to filter and analyze the content

Sends the formatted summary via Outlook email

This works perfectly for a single user — /me/ resolves to whoever owns the Graph connector connection, and the email goes to that person.

The challenge: I now need to scale this to 20-50 users across our Tax practice. Each user needs the flow to pull THEIR emails, calendar, and Teams data — not mine (the flow creator's).

What I've considered:

Cloning the flow per user — works but unmanageable at 50+ users (every prompt update = 50 edits)

Application permissions with /users/{email}/ — replaces /me/ with specific user endpoints, uses one Azure App Registration with admin consent, and loops through a SharePoint list of users. But this requires IT to grant Application-level Mail.Read and Calendars.Read permissions.

Sharing the flow as co-owner — each user sets up their own connection, but this requires manual setup per person and isn't seamless

My questions:

Is there a way to run a shared Power Automate flow where the Graph API /me/ endpoint automatically resolves to each individual user without them setting up their own connections?

For the Application permissions approach — is there a best practice for securely storing the Client Secret (Azure Key Vault?) and managing the SharePoint user list?

Has anyone built a similar "one flow serves many users" pattern with Graph API + AI Builder? Any gotchas with AI Builder credit consumption at scale?

For Copilot Studio: If I share the agent with users and they open it in Teams, does the agent's HTTP connector tools (Graph API) automatically use THEIR delegated credentials, or the agent creator's?

Environment: Power Automate Premium, Copilot Studio, AI Builder (Claude Sonnet 4.6), Microsoft Graph connector, EisnerAmper tenant.

Any guidance or patterns from people who've solved this would be hugely appreciated!

Categories:

Using flows

Building flows

I have the same question (0)

All responses (2)

Answers (0)

Sort by

Suggested answer

Sayali-MSFT Microsoft Employee on at

Like
a
(1)

Report
Copy link

Link copied!

Hello,
In Power Automate, a shared scheduled flow cannot dynamically use /me per user — it always runs under the identity of the configured connection. This is by design and aligns with Microsoft’s consent and auditing model. For scalable automation across 20–50 users, the correct enterprise pattern is to use application permissions in Microsoft Graph with /users/{id} endpoints, looping through a managed user list (Dataverse or SharePoint). This requires admin consent but is the supported and secure approach.
Client secrets should be stored in Azure Key Vault (recommended) or, where available, use Entra workload identity. Avoid storing secrets in SharePoint or environment variables for production scenarios.
AI Builder costs can scale non-linearly based on user count, prompt volume, and token size, so guardrails like pre-filtering content and skipping low-activity users are essential.

In contrast, Microsoft Copilot Studio runs Graph calls using the end user’s delegated identity, which is why /me works there — but it does not support background scheduled automation.

Recommended architecture:

Use Power Automate (application permissions) for background daily summaries and Copilot Studio (delegated) for interactive queries. This hybrid model is the standard enterprise pattern for scalable, governed AI automation.

Was this reply helpful? Yes No
MD35981 7 on at

Like
a
(1)

Report
Copy link

Link copied!

Thank you for the detailed response, Sayali!

I stumbled upon this article, do you think this would be the answer to my question? -

Configure triggers with end-user credentials | Microsoft Learn

New and planned features for Microsoft Copilot Studio, 2025 release wave 2 | Microsoft Learn

Was this reply helpful? Yes No