Enabling Flow

[Manolin010]

Good Day

We are fairly new when it comes to Microsoft Flow and so far we activated the license to just a small number of users. We have Office 365 Licensing for Flow covering all associates. There are no Plan 1 or Plan 2 licenses so we are subject to the default environment and any DLP controls Global Administrators to the Tenant can apply.  Generally speaking if we were to activate the Microsoft licensing to anyone in the company what would be the main risks or concerns (we have training material covered already).  Thanks

[jake · Accepted solution]

A couple thoughts...

Support

Enabling licensing for all users will enable all users to create Flows. That's good. Eventually, some flows will grow and evolve to the point that they are shared, becoming mission-critical pieces of automation for the teams using them. What does the support structure look like if something goes wrong w/ one of those Flows? Does IT pick that up? Does it fall back on the Flow creator?

Architecture & Governance

When everyone in the company can create Flows, you'll have a wide assortment of individual skill-sets with the ability to design and build automation solutions. For personal productivity, that's a good thing. For bigger projects, how do you ensure that things are built in the right way? (ie. not constructed in a way that burns unnecessary Flow runs, taxes the resources of connected systems w/ poorly-designed requests, overall poor architecture, etc.)

Bottom line: you can't. Governance moves from the tradional up-front model to a more reactionary stance... You'll need active Admin(s) keeping tabs on what's being built, where resources are being consumed, etc. and performing outreach and adjusting environment settings accordingly.

Consider creating a Flow COE (Community of Excellence) or whatever internal buzzword you want to use - an internal community for employees (IT + Business) who are interested in Flow automation, sharing projects and ideas, and establishing guidelines.

Security

You protect your organizational data with carefully-crafted DLP policies, thereby limiting the available connectors. After that, users can get as messy as they want, and IT and Compliance can rest assured your company's trade secrets won't get ported over to Facebook, Google Drive, etc.

[v-yamao-msft · Accepted solution]

Hi @Manolin010 ,

Flow is a public cloud service to help individuals and teams to set up automated workflows between their favorite apps and services to sync information, get notification, and more.

When it comes to connecting to any other services, sometimes we are afraid of security info posted on other social account, such as Twitter, Facebook, etc.

However, you could consider using DLP policies to restrict what connectors can be used within the same Flow, which means that you could restrict the use of organization-only data inside of Microsoft Flow.

https://flow.microsoft.com/en-us/blog/introducing-http-and-custom-connector-support-for-data-loss-pr...

Further, as long as you are an admin, you could restrict user’s ability to access organization’s business data, manage the assignment of the paid licenses inside of your organization though of Office 365 admin portal, etc.

Please get more details from the following doc:

https://docs.microsoft.com/en-us/flow/organization-q-and-a

By the way, when working with Microsoft Flow, you would reach to us for any issues related to Microsoft Flow, we are always ready to help.

Best regards,

Mabel

[Manolin010]

Good Day

Thank you all for the feedback, really appreciate it.