How to deal with business critical flows?

[mrQ]

Dear all

This might be a basic question...

Power Automate is such a great tool to create automation. Those automation are always initiated/created by one user. When using actions like Send Email, Post Message or anything in between, the credentials of this user will be used.

When it comes to business critical Flows that our users built, I'm aware that you should move them to a different environment than the default one and use solutions. But the connection "issue" is still valid. Meaning, despite moving those flows to the right place and treating them correctly, when a user leaves the company, those Flows will fail. 

How do you deal with this? Create a service user for those kind of flows? Is this even allowed - license wise? 

Thanks for your time

[manuelstgomes · Accepted solution]

Hi  

I've seen some people doing what you describe. For example, to have a service user that is considered the "production" account.

I will not venture more about licensing because there may be some fine line that can say that this is not possible, but since the approach is so common, I would think it's possible.

Please validate before doing it to be sure.

Cheers

Manuel

------------------------------------------------------------------

If I have answered your question, please mark it as "Accept as Solution." It will help other members finding the solution faster. If you like my response, please give it a Thumbs Up. ?

Otherwise, reply to it, and the community will do its best to help you.

[eric-cheng]

Hi @mrQ ,

I would recommend looking into the CoE starter kit here.

The kit consists of a core component as well as other tools to provide visibility and governance to Power Platform like reporting, application registrations and backlog management.

In regards to your question/s, there isn't really a straight forward answer as it is dependent on many factors as well as whether you have a top down or bottom up approach to rolling out Power Platform. 

Some organisations have a tiered approach whereby everyone is trained or must demonstrate a basic level of competency before being granted access to a personal environment.  After that, any app that is shared above a certain threshold of users may become 'business critical'.  This may then become something that becomes IT supported or warrant a conversation with the business developer to discuss support requirements and documentation.  Others have a more structured approach in which any application that is developed is first evaluated to determine the criticality and then placed in either the IT or business development bucket.  

Service accounts and data loss prevention policies are also levers which can assist in turning up/down the level of business led innovation.  Again, this is really just the tip of the iceberg but hope this provides some insights.

--------------------------------------------------------------------------
If I have answered your question, please mark my post as a solution
If you have found my response helpful, please give it a thumbs up

Connect on LinkedIn

[mrQ]

@eric-cheng 
@manuelstgomes 

Thanks for both of your answers. 

The CoE Kit is great and it certainly helps governing the Power Platform, but the issue with users building apps with their own connection still exists. Despite the Governance around it.

If you have an automation that at some point gets business critical, you probably don't want to use the credentials of the user who built it. Based on the answer from @manuelstgomes  I understand using a Service Account for these things are the way to go.

I feel like there is something missing from Microsoft to help with these cases. Just because something is low-code doesn't mean it can't be used for business critical apps/automation... and using a Service Account is also a security concern 😐