Answered

Connection reference turned to 'Provided by run-only' after publish

(1) Share

Report

Posted on by CU11121350-0

Hi,

I created an agent flow B for another agent flow A to call. Flow A could not be published since Flow B has a ‘Provided by run-only use’ Connection reference. I switched to the owner from the Manage Connection reference; the change could be saved, but as long as I published the flow, the connection reference reverted to 'Provided by run-only user'.

My flow was triggered by 'Manually trigger a flow' and used SharePoint(read file content) and Outlook(send email) connectors. These connection references were used as the owner type in other flows.

Categories:

Calling actions from Copilot Studio

I have the same question (0)

All responses (5)

Answers (2)

Sort by

Suggested answer

Haque 3,197 on at

Like (0)

Report
Copy link

Link copied!
Hi @CU11121350-0,

Let's find out why connection reference revert to Provided by run-only user:

When we create a flow (sau, Flow B) that is called by another flow (say, Flow A), and Flow B uses connection references with run-only user permissions, Power Automate enforces that the connection references are set to "Provided by run-only user" to ensure security and proper delegation.

Even if we change the connection reference owner manually in the flow editor, publishing the flow resets it to "Provided by run-only user" because the flow is expected to run under the caller’s context (Flow A’s run-only user).

This behavior ensures that the calling flow (Flow A) controls the connections and permissions, avoiding unauthorized access.

Best Practices to Manage Connection References in Called Flows

Use Shared Connection References with Proper Permissions: Let's ensure that the connection references used in both flows are shared with the same users or service accounts that will run the flows. The run-only user permissions should be configured to allow the necessary actions on SharePoint and Outlook.

Configure Run-Only User Settings in Both Flows: In Flow B, configure the run-only user settings to allow the calling flow’s service account or user to provide the connection. In Flow A, ensure the run-only user settings include the same connections and permissions.

Avoid Changing Connection Reference Owners Manually: Instead of changing the owner in the flow editor, manage permissions via the Power Platform admin center or environment settings. Connection references are designed to be shared and delegated, not owned individually per flow.

Use Service Accounts for Connections: For unattended or automated scenarios, use service accounts with delegated permissions for SharePoint and Outlook connections. Share these connection references across flows to maintain consistency.

Check Environment and Solution Context: If your flows are part of a solution, connection references behave differently and are managed at the solution level. Ensure connection references are added to the solution and shared properly.

I am sure some clues I tried to give. If these clues help to resolve the issue brought you by here, please don't forget to check the box Does this answer your question? At the same time, I am pretty sure you have liked the response!

Was this reply helpful? Yes No
CU11121350-0 33 on at

Like (0)

Report
Copy link

Link copied!

Hi @Haque

I am sorry, I do not fully understand. The error in Flow A was the following when Flow A was published:

“Action 'xxxxx' has defined a child flow that contains 'run-only user' connections. Update the child flow for action 'xxxxx' to not use 'run-only user' connections.”

Did you mean I should use "Provided by run-only user”? The error seems that Flow A did not like it.

How could publishing just silently change it to"Provided by run-only user”? Should it let me know with an error first, or should it not even let me change it in the first place?

I am new to flow. For an agent, it is clear who will run it. A flow is triggered by a schedule that no one runs. How can I set which user to run as?

Was this reply helpful? Yes No
Suggested answer

Haque 3,197 on at

Like (0)

Report
Copy link

Link copied!
Hi @CU11121350-0,

Point-2 I mentioned earlier will help you to resolve the issue.

Here we go again:

Configure Run-Only User Settings in Both Flows: In Flow B, configure the run-only user settings to allow the calling flow’s service account or user to provide the connection. In Flow A, ensure the run-only user settings include the same connections and permissions.

It means: "run-only user settings" must be same for both flows (Flow A[Caller] and FlowB[Callee]). Let's make sure these two flows:

Step 1: Configure Run-Only User Settings in Flow B (the called flow)

Open Power Automate and go to My flows.

Find Flow B (the flow that will be called by Flow A) and click the three dots (ellipsis) next to it.

Select Run-only users.

In the Run-only users pane, click + Add users.

Add the service account or user account that Flow A uses to run or call Flow B.

For each connection listed, ensure that the added user or service account has the correct connection configured or can provide their own connection.

Save the settings.

Step 2: Configure Run-Only User Settings in Flow A (the calling flow)

In Power Automate, locate Flow A.

Click the three dots (ellipsis) next to Flow A and select Run-only users.

Add the same service account or user account that will run Flow B.

For each connection listed, ensure the user or service account has the correct connection configured.

Save the settings.

Let me know if this help.

Was this reply helpful? Yes No
Verified answer

CU11121350-0 33 on at

Like (2)

Report
Copy link

Link copied!

Hi @Haque

I took the following test. I created a two-step parents flow. A "Manually trigger a flow" trigger and a "Run a Child Flow" action; it did not use any connection. The child flow connection reference was "Provided by run-only user" (set by the system after being published).

Copilot Studio wouldn't let me publish the parents flow with the error : Action 'Run_a_Child_Flow' has defined a child flow that contains 'run-only user' connections. Update the child flow for action 'Run_a_Child_Flow' to not use 'run-only user' connections.

I went back to the child flow and did what it said, changed the connection reference to a fixed connection without publishing. Then I could publish and call the child flow.

Then, I change the connection in the child flow back to "Provided by run-only user". I could no longer test the parent flow. The child flow must change to a fixed connection before it can be run again.

Was this reply helpful? Yes No
Verified answer

Haque 3,197 on at

Like (2)

Report
Copy link

Link copied!
Hi @CU11121350-0,

Fundamentally, Power Automate requires that child flows invoked by a parent flow do not rely on connections configured as "Provided by run-only user." These run-only user connections are designed for manual triggering scenarios and are not supported for programmatic invocation from parent flows.

Takeways:

Child flows invoked by parent flows cannot use run-only user connections.

You must update the child flow to use fixed connections.

After updating, publish the child flow to apply the changes.

Then the parent flow can be published and run successfully.

Was this reply helpful? Yes No