Governance/Monitoring Power Automate Desktop Flows

[BennyS27]

Hi community

we are currently at the rollout/governance model for the power platform for citizen devs. In my opinion, we have modelled the governance quite well so far but the only thing that is unclear for me is governance of power automate desktop.

How can we monitor what people are doing via desktop flows to prevent uncompliant actions via buttons/clicks?

Is there a way to retrieve information about power automate desktop actions via API or flow? Or is there a way to retrieve a "xaml" like file for the desktop flows on which we could build a parser to create an overview? (go through each desktop flow, retrieve the xaml file or a json about the actions?)

Or what would you recommend in this scenario?

Thanks a lot in advance!

[Deenuji]

1. @BennyS27 
   With respective to the power automate desktop governance we can use below features:
   Monitor Desktop flow - You can use "Desktop flow activity" to monitor all you desktop flow activities. 
2. Power Platform COE Starter Kit: You can leverage the Power Platform COE Starter Kit to monitor flows and determine which environments have more desktop flows, similar to Power Apps and cloud flows.
3. Automation Kit: You can use this kit to monitor your KPIs.
4. DLP Policy: Similar to Power Automate Cloud, we have a DLP policy here that allows us to restrict any packages from being used by developers. Read more on - https://learn.microsoft.com/en-us/power-automate/desktop-flows/data-loss-prevention 
5. Orphan Flow: We can utilize the Power Automate API to identify orphan flows within your environment as well.

Hope this helps!! Please let me know in case if you have any additional questions.

Thanks,
Deenuji Loganathan
🤖 Automation Evangelist
Deenuji - Follow me on LinkedIn

-------------------------------------------------------------------------------------------------------------
If I've helped solve your query, kindly mark my response as the solution ✔ and give it a thumbs up!👍 Your feedback supports future seekers 🌟

[BennyS27]

Hi @Deenuji ,

thank you for your fast response. I know about these possibilities but unfortunately this does not give any insights into what is really happening - also regarding DLP - and therefore does not provide a solution to our requirements. If someone is using mouse and button clicks to visit twitter and post something there, there is no way of prohibiting it, right?

Thanks!

[Deenuji]

@BennyS27 

I acknowledge your concerns, and in this particular scenario, I completely agree with you.

The issue pertains to URL filtration during the "Launch browser" action to prevent navigation to Twitter. Such governance features are currently available in Power Automate Cloud, where we have endpoint filtering through Connector endpoint filtering (Connector endpoint filtering (preview) - Power Platform | Microsoft Learn ). However, these features are not present in desktop DLP policies. 

I anticipate that the same options will soon become available in Power Automate Desktop as well. However, I would suggest considering the creation of custom code if your team possesses the capability to consume desktop flows from Dataverse. This would enable the scanning and generation of reports related to this issue.

Hope this helps.

Thanks,
Deenuji Loganathan
🤖 Automation Evangelist
Deenuji - Follow me on LinkedIn

-------------------------------------------------------------------------------------------------------------
If I've helped solve your query, kindly mark my response as the solution ✔ and give it a thumbs up!👍 Your feedback supports future seekers 🌟

[BennyS27]

Thanks @Deenuji ,

indeed. For a compliant power automate desktop roll-out, a more high-level admin perspective monitoring should be possible. In the CoE Kit admin app, there are insights into actions used by cloud flows and also information about HTTP endpoints for the HTTP request trigger for example. 

I would be also happy if there is a way to retrieve a kind of like "xml" file for each power automate desktop flow in the environment so that we can scan those. As far as I've seen there will be temporary file cached when opening a PAD flow locally in the app, but there is no official way (afaik) to export a file for a PAD flow...

I will continue diving into that. 

[Deenuji]

@BennyS27 

There are two methods to accomplish this:

1. Utilize the Power Automate API to export the desktop flow (API Details mentioned below). Then, you can construct a mechanism to create a dashboard on top of it.

    For more details refer - Work with cloud flows using code - Power Automate | Microsoft Learn 

POST [Organization Uri]/api/data/v9.2/ExportSolution
OData-MaxVersion: 4.0
OData-Version: 4.0
If-None-Match: null
Accept: application/json
Content-Type: application/json; charset=utf-8
Content-Length: 472

{
  "SolutionName": "FlowContainer",
  "Managed": false
}

2. Alternatively, you can employ the Dataverse table named "Processes." Here, you can access all the flow details within the "Definition" column. With some dedicated effort, you can easily scan entire action used and create some dashboard top of it.

Thanks,
Deenuji Loganathan
🤖Automation Evangelist
Deenuji - Follow me on LinkedIn

-------------------------------------------------------------------------------------------------------------
If I've helped solve your query, kindly mark my response as the solution ✔ and give it a thumbs up!👍 Your feedback supports future seekers 🌟

[BennyS27]

I just checked the possibility to include the desktop flow in a solution and export this as a zip file. 

However, the resulting json contains an encoded package string - decoding via base64 is not revealing any information. 

Do you think the API call is revealing more information than that about desktop workflow actions? I somehow doubt that. 

Also, I cannot see a Dataverse table called Processes. However, this brought me to the "v1->v2 schema" topic. I enabled the v2 for the environment now but I am not able yet to migrate the v1 flows to the v2 schema. Maybe the created dataverse objects yield more information. 

[Deenuji]

@BennyS27 

I am not sure about the schema topic and let me check the export option encoded topic sometime later this weekend. But this is how I am exploring my desktop flows details in process table.

Click on tables from the power automate page like below.

Then if you look at processes table, we can access the schema as follows. We can then extract our code from there and we can build something for scanning the same.

Thanks,
Deenuji Loganathan
🤖 Automation Evangelist
Deenuji - Follow me on LinkedIn

-------------------------------------------------------------------------------------------------------------
If I've helped solve your query, kindly mark my response as the solution ✔ and give it a thumbs up!👍 Your feedback supports future seekers 🌟

[BennyS27]

@Deenuji Thanks again for your effort. I tried my best, but I cannot find any table in "Tables" which holds Power Automate Desktop Information.

Exporting a solution reveals a json file for each desktop flow but with an encoded package description.

I tried to decode it using base65 but there is only nonsense coming out - is it a different encoding scheme?

I suppose that the API call you mentioned above is also only yielding this string?

In Schema V2 this package string is not existing anymore in the exported json file but there are desktop flow binaries which provide information about runs and screenshots. 

Just recapping: I would like to have an xml/json/text which contains exactly the text which you can see in the UI of the Power Automate Desktop Application, so action + uielements + variables etc. 

[Deenuji · Accepted solution]

@BennyS27 

Did you selected "All" while checking the processes table?

Direct URL to access processes table:

https://make.powerapps.com/environments/youenvironmentid/entities/e5c40599-99d3-453d-8594-8d55e29a9579

Replace the above red highlighted url with your environment id. To get your environment id, navigate to make.powerautomate.com and choose your environment and press Ctrl+Alt+A and you see one tab opening with environment details like below.

Regarding solution export approach, I will check and let u know by this weekend.

Thanks,
Deenuji Loganathan
🤖Automation Evangelist
Deenuji - Follow me on LinkedIn

-------------------------------------------------------------------------------------------------------------
If I've helped solve your query, kindly mark my response as the solution ✔ and give it a thumbs up!👍 Your feedback supports future seekers 🌟

[BennyS27]

Aaaaah I haven't seen the "all" button - what a rookie mistake.

I found the table and indeed the table contains interesting column as e.g. definition ! I will deepdive here. Thanks a lot already!