Restrict Access to Microsoft Flow

(0) Share

Report

Posted on by AshishJaiswal

776

Hi Team,

Is there a way to restrict end user to only approve/reject flow

enduser should not be able to create any new flow - just approve/reject

I tried removing the license for flow, for free flow and for power automate - no luck

Please help

Categories:

General topics

I have the same question (0)

All responses (4)

Answers (0)

manuelstgomes 6,625 on at

Like (0)

Report
Copy link

Link copied!

Hi @AshishJaiswal

The license must be there even if one of the free ones. The user needs "permissions" to run the action so I don't think that's possible, sorry.

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

Cheers
Manuel

Was this reply helpful? Yes No
AshishJaiswal 776 on at

Like (0)

Report
Copy link

Link copied!

Hi,

I have removed the below licenses but user is still able to access the flow, powerapps and PVA

Was this reply helpful? Yes No
AshishJaiswal 776 on at

Like (0)

Report
Copy link

Link copied!

@manuelstgomes , please advise

Was this reply helpful? Yes No
LimeLeaf 278 on at

Like (0)

Report
Copy link

Link copied!

Hi @AshishJaiswal,

migrate the power automate flow to a admin or service user and test if the enduser can trigger it. Then create a AD policy that blocks power automate.

In detail:
1) Run the flow on a service user or admin user. For a service user create a "normal" user with permission to the resources the flow is affecting e.g. Teams Channel or Outlook share mailbox and equip him with the appropriate license e.g. E3. Migrate the flow to this service user and make sure all connections of the flow are running on the new user. Then test if the enduser can trigger the flow.

2) Implement an AD policy as described here from the Microsoft DEV Blog.
https://devblogs.microsoft.com/premier-developer/control-access-to-power-apps-and-power-automate-with-azure-ad-conditional-access-policies/
Block with this permission all users except the service user who owns the flow.

Then the endusers should be able to particapte in an approval process but they will not be allowed to even enter power automate to create flows.

Note:
Some triggers will not work with such an AD policy e.g. to trigger a flow from sharepoint libary for a specific document.

This solution helped us to restrict who is capable of creating flows. In combination with a multiple environment strategy.
https://docs.microsoft.com/en-us/power-platform/guidance/adoption/environment-strategy

Cheers

Was this reply helpful? Yes No