How to find Flows shared with "run only" ?

(0) Share

Report

Posted on by DavidForlen

Hello,

I have developed a Flow in a solution that I want to share with other user.

I just want them to be able to run the flow, nothing else.

The "Run only" option seems to be the way to go, but users can't find the Flow shared with this mean.

If I gave them the URL of the Flow, they have the same rights as me, even if I don't share the Flow with them. ie : they can add new Owner, edit the Flow...

I read that an email should be sent when I share the Flow with "Run only" permission, but nobody receives it.

I don't want them to be forced to install anything on their phone, even if I'm aware that "Run only" flows should be launchable from there.

Is there a way to launch a Flow shared via "Run only" permission without installing the mobile app ?

Thanks !

Categories:

Using flows

I have the same question (0)

All responses (4)

Answers (0)

Sort by

fchopo 8,003 Moderator on at

Like (0)

Report
Copy link

Link copied!

Hello @DavidForlen
You could create a flow that is triggered with a "When a HTTP request is received" using the GET Method:

In this way, you can share with the user the HTTP GET URL (generated when you save your flow for the first time). Anytime the user uses this URL, the flow is going to be triggered.
Hope it helps!
Ferran

Was this reply helpful? Yes No
Jessie Chen on at

Like (0)

Report
Copy link

Link copied!

@DavidForlen Is this a button flow? We can only share button flow with run-only permission. Seems the user is co-owner of the flow now. More details about how to share a button flow: https://docs.microsoft.com/en-us/power-automate/share-buttons Best Regards, Jessie Chen

Was this reply helpful? Yes No
DavidForlen 55 on at

Like (0)

Report
Copy link

Link copied!

Thank you @fchopo for replying !

I tried it quickly, as my button Flow is only there to call another Flow trigerred with a "When a HTTP request is received".

I'm still searching how to pass parameter in the URL, as the Flow need to know the email adress to notify at the end.

However, I realized that this solution isn't satisfactory yet, security wise.
As this URL can be shared to anyone and the recipient email can be changed in the URL, anyone can launch the Flow and collect sensitive data from the email. And this without me being able to prevent them to do so.

But at least they won't be able to modify the Flow and reuse the connexions for other purposes.

Any idea in order to avoid this risk ?

@shuI'm not sure to understand your response. During my tests, I tried to share my Flow with "Run only" permission. And the users couldn't find the Flow anywhere.
If I give them the URL of the Flow, they have all rights on it. Whether they have "run only" permission or not. And I keep ownership of the Flow to myself.

The link you gave seems usefull, but it talks only about the mobile app.

Was this reply helpful? Yes No
fchopo 8,003 Moderator on at

Like (0)

Report
Copy link

Link copied!

Hello @DavidForlen
You are right about the security issue, and then, that's probably not the best option to share a Flow with other users.
At this point I think there's no easy solution for what you are looking for.
Hope someone else can help you.
Regards,
Ferran

Was this reply helpful? Yes No