A query regarding running flows in the context of a service account

[CH007]

Hi All,

This query partly relates to the following post, regarding an app triggering flows (running in the context of a user).

I thought we had a resolution to this, in granting the users the 'Flow-RP' role, however the third party we work with advised against this stating it would give the users too high a level of permissions.

https://powerusers.microsoft.com/t5/Building-Power-Apps/Connection-not-configured-for-this-service/m...

They have advised that the most reliable way is to run the flows in the context of a service account. I would just like to try and confirm the following to ensure we aren't going to run into any problems (if we run the flows in the context of a service account).

Environment

• Which security role would users require at the environment level?
• Would the out of the box 'Basic User' role be sufficient? Or would the users require a customised copy of the 'Basic User' role with Organisation Read on the Process and Solution Tables?

Flows

I understand I would need to change the 'Run only users' settings and amend the 'Connections Used' from 'Provided by run-only user' to 'Use this connection (Service Account Name)'

• (Under the 'Run only users' settings for each flow) Does the flow have to be shared with any user(s) who needs to be able to trigger the flow from the app?

Obviously the App and any datasources also need to be shared with the user(s), is there anything I have missed in terms of settings that need to be configured in order to get this to work with both a unmanaged and managed solution?

Any help with this would be much appreciated, thanks.

[BCLS776]

Before you go too far with this, make sure you are not using the service account to bypass premium licencing requirements for app users as doing so could violate the agreement with Microsoft. I assume that because you are using Dataverse that all users will have a Premium licence of some sort.

As well, make sure the usage of the service account connector by others will not surpass the service limits for each kind of datasource; otherwise, users will experience intermittent outages or the service may suspend the account for excessive use.

And, from that point forward each CRUD operation will appear to be done by the service account. From a governance and audit perspective, this is troublesome because you lose the ability to easily understand how changes are happening to the data.

You are correct you will need to point each connection for each flow to use the service account connection and the connection must be shared with all potential users of the app.

For security role, app users will still need access to the Solution and Process tables or they will not be able to trigger the flow(s). As well, they will need access to any tables present in the app, including custom tables.

Hope that helps,

Bryan

[CH007]

Hi @BCLS776,

Thanks for your response.

Just to advise, I am using SharePoint lists as the data source and not using any premium features, so I don't think the users will need premium licenses.

The flows will mainly be used to send emails. I think that the emails will be sent from the service account rather than the user who triggered the flow doing it this way.

In your response you said "You are correct you will need to point each connection for each flow to use the service account connection and the connection must be shared with all potential users of the app."

Just to make sure I understand, where you say 'the connection must be shared with all potential users of the app', do you mean the connection or the flow? If this is the connection can you advise how to share it?

In the final part of your response you said "For security role, app users will still need access to the Solution and Process tables or they will not be able to trigger the flow(s). As well, they will need access to any tables present in the app, including custom tables."

Would the out of the box 'Basic User' role be sufficient for the users to be able to trigger the flows from the app?

Thanks for your help

[BCLS776]

---

@CH007 wrote:

Hi @BCLS776,

Thanks for your response.

Just to advise, I am using SharePoint lists as the data source and not using any premium features, so I don't think the users will need premium licenses.

The flows will mainly be used to send emails. I think that the emails will be sent from the service account rather than the user who triggered the flow doing it this way.

A simpler way to do this is to create a Shared Mailbox, add all potential users to it as members, and utilize the "Send As" functionality of the Outlook connector to send the email. The downside is that everyone has access to the shared mailbox and all messages will be visible to them. Not sure if that fits your use case.

---

@CH007 wrote:

Hi @BCLS776,

Thanks for your response.

In your response you said "You are correct you will need to point each connection for each flow to use the service account connection and the connection must be shared with all potential users of the app."

Just to make sure I understand, where you say 'the connection must be shared with all potential users of the app', do you mean the connection or the flow? If this is the connection can you advise how to share it?

---

 You can share connections by going to the Connections area in Power Automate, clicking on the connection (there may be more than one instance of it) and specifying which users may use it.

---

@CH007 wrote:

In the final part of your response you said "For security role, app users will still need access to the Solution and Process tables or they will not be able to trigger the flow(s). As well, they will need access to any tables present in the app, including custom tables."

Would the out of the box 'Basic User' role be sufficient for the users to be able to trigger the flows from the app?

Thanks for your help

---

Last time I checked, Basic user did not explicitly include permissions to the Solution and Process tables, so you'll need a slightly customized role.

Bryan