Need to use another User's connections on a Flow

[FacundoGorla]

Hi, I'll give some context with my problem. 

I created a flow that uses Sharepoint, Exchange, o365 and Forms connections.

Now, I created it with an account that I want to disable/erase in the future. 

I already shared the Flow to another account but it still uses my Connections and I'm not able to add Connections to that flow in particular. 

I know that from "Connections" you can add another account connections but that won't add them to the flow I want to.

I tested and if MY account (the one that created the flow) loses the permission to SharePoint or gets disabled the Flow stops working even if it's shared with another user that can use and acces all the Application/sites/files used in the Flow.

In less words: the connections of a Flow can't be changed, they can be removed but can't add specific ones.

Any ideas/help with this?

Also tried to delete my connections, add someone's else and THEN create the flow but still doesn't take them into account.

@Flowinsight 

[FacundoGorla]

The only solution I find is to create a flow with the account wich Connections I want to use and then Share it with the account that I want to create the flow with.

[ScottShearer · Accepted solution]

@FacundoGorla 

You can, in fact, add connections for anther user and switch the actions to use the new connection.  You'll need to know the new users email and password.  You can do this eother from the Flow design environment or from the connections screen.  Clcik on Add a new connection.  When the screen appears to specify an account, it will default to you - the current user.  Click on "Use another account" and provide the email and password.  If you do this from the connections screen, you'll still need to go back to every action and switch the connection from your account to the new connection that you created.  You'll likely have to create a number of connections - one for each connection type used.

Also, you'll probably want to add the new user as a co-owner of the Flow.

[FacundoGorla]

Oh, that's exactly what I was looking for. Thanks! It's a little tedious to go action by action but since I already have the flow working I think I'll do that.

How would you do this kind of implementation or what's the recomended one?

I think creating the flow with the user that I want to use connections, then adding myself as a Owner and work the flow from there. 

This is because I have a temporary account on my client organization and that account may be erased once the implementation is finished.

[ScottShearer]

I suggest creating the Flows when using the "permanent account" and adding your temp account as an owner.

[BTbearings]

I am doing exactly this process, but when I switch the connections (i.e. switching from the original owner's connection to the new co-owner's), many of the contents/settings I have in the fields of the action get erased.  Can I stop this from happening?

For instance, when I change the "Add a row into a table" action that is connected to Excel Online, I lose everything I had for each of the columns.  It keeps the top few fields (Location, Document library, File, and Table), but everything else is now blank.

Is there a way to switch the connection without losing this?

[DeeTronSEAM]

I am seeing MASSIVE instability when changing connections used within flows....for the most part with SQL (both OnPrem and Azure) data sources/actions.

Since we develop the PowerApp+Flows in a dev environment and then use the package export feature to deploy the app+flows, there are two points during the deployment process where connections may get changed.

1) during the initial "import" into our production enviro.

2) after the flow is in the new enviro and we change an action's connection using the method @ScottShearer (excellently!) described.  We have not narrowed down which method is more problematic (or not), but MASSIVE amount of time is being wasted on the "bumps in the road" that such connection "re-alignments" cause.  

Has anybody else figured this out or seen similar problems?  Best advice I've heard so far is to do all dev work using/as your service account and add actual human users as co-owners.  It makes sense (as it would prevent, mostly, the need to change connections), but not a proven workaround...and really, it's an ugly workaround to what "should just work."

[Gabor88]

One additional question guys..

Can I change connections of a flow while it has "running" flows in the meantime?

[Anugrah17]

Somehow my connection got changed to the other email id and now wherever i click on add connection it always directly add the other unwanted account and dont even ask me to signin with new account. let me know if someone have a suggestion

[ericonline]

I do want to point out the security issue here:

- You should never share your Windows credentials so someone else can create a connection in Flow on your behalf

- You should (in my humble opinion) never share a Flow with someone else that uses your connection

  - Only export and share a copy of a Flow. This will require the other person to use their own connection

Rationale:

- Sharing personal login credentials is bad bad bad. Never do it.

- A nefarious (or upset, or x, y, z) person could do some nasty stuff on your behalf when you share your connection

Fix (NOTE: I have not tried this as its not allowed in my org):

- Create a generic Active Directory account (PowerApps@mycompany.com email address + security principal)

- Assign the generic AD account appropriate O365 licenses (+PowerApps / Flow premium lic's if needed)

- Login to your computer using your credentials

- Login to PowerApps/Flow using the generic credentials. Create all PowerApps/Flows in this context.

- THEN, when you share a Flow, its running under the generic creds, not your personal creds.

[Anonymous]

It is 2020 and still no easy solution from Microsoft to switch all connection users to whoever I want on existing flows.

"go back to every action and switch the connection from your account to the new connection that you created.  You'll likely have to create a number of connections - one for each connection type used."  Seriously ?

THIS IS A VERY VERY BAD DESIGN. I AM VERY ANGRY AT THIS !!!!!! 

How can Power Apps/ Platform community live with this ? Do we need to host a protest rally to get this fixed ?

[IrisGuo]

Hello all,

I have shared my Flow to another user, but something is wrong when I add her connection to the Flow:

1. In the action of <O365 Outlook>, I click on "Add connection"

2. I click on "Another user account" in the pop-up window

3. I fill out the email address of that user account, then click on "Next"

4. No field pops up to let me fill out the password of that user account, but instead my own connection is created. That means, finally I create a duplicated my own connection to the Flow, which is not as expected.

Please help to check and assist, thanks!

[dpond]

I had the same issue.  Before you select "Another user account" in the pop-up, click the 3 dots to the right and select "Sign Out".  Then you'll be able to enter the password for the other account.  Note it may take a minute or two for this new connection to show up under "My connections" for your actions.

[Anonymous]

For the purple approval action steps what is the best way to change connection for that? Clicking the ... only shows Approval. Do I still follow the same method as other actions by getting the new user I am switching to to click and sign in here for the approval action? 

[rrahim]

I agree. I'm new to using Power Automate, but there are too many situations like this which seem unintuitive to set up. Now doing research on how to set up flows properly, I'm finding that there isn't quite an acceptable solution yet.

[Nicolas07]

another issue on the same topic:

because no one is eternal in an organisation, it would make sense to have shared flows (owned by a Group) to use the Group's connections. Especially for automatic cloud flows that do not require a particular user to log-in and trigger the flow themselves.

But this is not possible, so instead I have Group-owned Flows that run on Group-owned Forms and Group-owned Sharepoints, but that are depending on my own connections. So if I lose my job tomorrow and my account is closed, all those flows will immediately stop to work...

[ScottShearer]

@Nicolas07 

I agree.  That is why many Flow users use a "service account" and use the service account for all of the connections.  A service account, for this purpose, is a shared account that does not belong to a single individual.  Yes, you are burning an M365 license for the account and the account will need permissions as appropriate to any resources accessed by the Flow.  A service account never gets fired.

[Nicolas07]

Hi Scott,

I see how a service account would solve this and other issues. Though I think it's a significant security problem: there is an account with some privileges and its credentials are shared among a (potentially large) number of persons. In my view this is a big no-no from the security standpoint.

I think it is great that ownership of flows, forms, sharepoint lists, etc. can be given to groups. I understand the technical obstacles of assigning connections to groups, as they are deeply linked with actual O365 accounts, and not permissions.  Still, I think finding a solution there would make many people more comfortable. In my view it is a major obstacle to the wider usage of Flows / Power Automate in organizations (by wider I mean: not restricted to IT teams and other geeks - like me 🙂 ).

[ericonline]

@ScottShearer , one consideration with this approach is SCOPE. In large orgs, its not desirable to have a single "service account" with permissions across many different Sharepoint/SQL/etc. data sources and O365 connections. Its easy to suddenly find yourself with a service account that has "God mode" permissions (dangerous).

To reduce this risk, perhaps a service account per team (or even per Flow) is more appropriate. Something to consider!

[ScottShearer]

@ericonline 

I agree and certainly did not to  imply otherwise.