Sharing Desktop Flows / read only

[AndreasSta]

When sharing a desktop flow with another user, the user sees the flow in the Power Automate for Desktop app and cannot edit it either.This is fine and desired. But he can copy the flow in the desktop app and then he can edit the copied flow. Is there a way to prevent the user from copying the shared flow?

Thank you

[MichaelAnnis]

When you add people to a flow inside of a solution, there should be tow options (Owner or User).  

An Owner can download the flow to there Desktop app with the SaveAs button, but a User should not be able to.

Find the flow on the online site, and go to "Managed Access".  Change the person to a User.

[AndreasSta]

Thank you for your reply.

I did it exactly like you described. The flow was shared only with user rights. But the user can bypass the permissions by copying the flow. Copying is still possible even if you have only user permissions. After you have copied the flow you are the owner of the copied flow and can edit it. So my question is if you can turn off the copy function (only for shared flows) or configure the user rights in a way that the user is only allowed to run flows in the desktop app, but not edit, copy or even create new flows.

Have a look at the Screenshot, it is from the Desktop App. Editing of the shared flow is deavtivated but you can still copy the flow. That is the problem.

[MichaelAnnis]

No, I would open a ticket with Microsoft, but this may be by design. For instance, any read-only file can typically always be copied and modified. 

[tpeixinho]

@AndreasSta have you ever found any solution to this?

[AndreasSta]

My workaround was to outsource part of the code (the critical part) and run it on a cloud flow. This means that the desktop flow gets part of the calculation (logic) from a cloud flow, over which I have complete control. So the user only gets the result back, but cannot acquire the knowhow. Even if the user copies the desktop flow and looks into the code, he doesn't see how the calculation is done but only sees a GetRequest (http trigger) to an external flow. 

Not ideal but works in my scneario well. 

[aljer8118]

I have the same problem, and this is a nice workaround. Thank you.

[agadari]

Hi, I've just come across this ticket but we have solved this issue by creating a custom security role where we restrict user from creating copies.

By copying "Basic user" security role and restricting "Create" and "Write" privileges in Process table.

[AndreasSta]

Thank you, In the meantime I found also another way to solve that: 

1. create a new solution

2. then you add your existing flow to the solution

3. then you export the solution as a managed solution to avoid users from copying or editing your flow

[Absnaky]

I've been trying to look for a solution to this issue for the past few days, it's been a challenge, lol!!

@AndreasSta I tried what you suggested about Creating a Solution, Adding your desktop flow to it then Exporting it as a Managed Solution.

I uploaded the new Solution in a different Environment and indeed the "Edit", "Create a Copy" and "Share" feature were all disabled as shown in the picture 1 below.

However, when I go into the Power Automate Portal (https://make.powerautomate.com/), creating a copy through the "Save as" feature is still available!! (picture 2)

I tried a few things but nothing seems to fully solve the issue.

Did you experience the same difficulty??

@agadari 

I also tried your suggestion on copying the "Basic user" security role and restricting "Create" and "Write" privileges in the Process table.

I even tried to disabled all the "Create" and "Write" permissions, but the "Save as" option to create a copy is still showing up!

Can you please share a bit more on how you did it?

[AndreasSta]

Hello, yes, unfortunately you can still copy the flow in OWA (Online Web Access). In my scenario, the users only have access to the desktop client and do not have OWA access. Unfortunately, according to Microsoft, there is no solution to avoid copying in OWA.

[Agnius]

Try blocking unmanaged customizations in your target environment - this will prevent people from creating flows directly into this environment, effectively also preventing them from making copies of your flow. See here for reference: https://learn.microsoft.com/en-us/power-platform/alm/block-unmanaged-customizations

In addition to that, you can also apply security roles to a team of the users in question, so they simply are not allowed to create flows. That's essentially what you need - if you want to prevent them from copying a flow shared with them, you must block them from creating flows in general. Set them as "Basic User" only and remove the "Environment Maker" role, and you should be good to go. See here for more info on user roles: https://learn.microsoft.com/en-us/power-platform/admin/database-security