(MC713667) Power Automate may be affected by Power Platform API being blocked by a firewall or conditional access policy

[ChrisGarty]

On February 22nd 2024, message center communication MC713667 was sent to customers. Here is a lightly updated version of that message...

=================

Beginning on February 29, 2024, Microsoft Power Automate will transition to a new cloud service dependency named Power Platform API. The Power Automate experiences, along with other Power Platform experiences in the future, will utilize this new API internally.

How does this impact you?

We have identified that your environment might face connectivity issues with https://*.api.powerplatform.com due to a network firewall or conditional access policy. The Power Platform URLs and IP address ranges are crucial for the proper functioning of the Power Platform API. From February 29, 2024, onward, your service could be adversely affected in the following scenarios:

1. If you utilize in-house firewall rules to restrict network traffic to specific URLs or IP addresses, this change could lead to service interruptions if not addressed.
2. If you have implemented Azure Active Directory Conditional Access policies targeting the cloud service "Microsoft Flow" or "Microsoft Power Platform API," be aware that as client experiences (e.g., https://make.powerautomate.com) transition to "Power Platform API," Conditional Access policies targeting "Microsoft Flow" will no longer enforce the same access controls.

In the commercial cloud, the referenced cloud services and their corresponding application IDs are:

1. "Microsoft Flow" application ID: 7df0a125-d3be-4c96-aa54-591f83ff541c
2. "Power Platform API" application ID: 8578e004-a5c6-46e7-913e-12f58912df43

Note that this cloud service dependency change applies to all clouds.

What action is required?

Please update your firewall rules or conditional access policy to permit traffic connecting to the new Power Platform API URLs, as detailed in the Power Platform URLs and IP address ranges documentation.

=================

Also see this additional documentation: IP Address configuration to enable use of Power Automate. 

If you have questions about this transition or want more information about the process of updating firewall rules, please post a question below.

Thanks!

[v-rburgula]

Hi  Thank you for the post. 

I have a couple of questions on this:

1) How did Microsoft identify the environment as being impacted and blocking these endpoints

2) How do we test to verify nothing is blocked, IE can we simply call URLS and if we get a response other than 500 then there is no issue?

3) When was this change happening on 29th? no time is mentioned.

@ChrisGarty

[ChrisGarty]

Hi @v-rburgula,

1. The identification was done using internal logs.

2. Yes, Sachin Mathur is going to provide some more guidance on this here...

3. The change was delayed due to the number of customers affected.

[v-rburgula]

Thank you for the response.

It would be great if you could assist me on this:

How do we test to verify nothing is blocked, IE can we simply call URLS and if we get a response other than 500 then there is no issue?

Thank you, waiting for a response.

@ChrisGarty

[sachin_mathur]

Hi @v-rburgula 

Navigate to Microsoft Power Automate and review the network trace in your browser. Inspect values listed under cluster?api-version=1. If you see an error (see screenshot below) then this needs to be addressed using the instructions provided in the article. 

A successful run would look like this:

Let us know if you have any additional questions. 

Regards

@sachin_mathur 

[ekutarnia]

Hi @ChrisGarty  @sachin_mathur So I'm a bit confused, we were one of the customers who were 'identified' and sent this email. Currently when I use the browser dev tools on the browser and follow the steps above, there are not any errors for the endpoint in the network trace: 'xxxxx.tenant.api.powerplatform.com/gateway/cluster?api-version=1'.  However we were still identified? So is getting a 200 http code back from the mentioned API adequate testing prior to this change? If it is, was there an issue with the log trace that identifies customers? My main concern here is we have a lot of apps/flows etc., deployed and this is a very ambiguous email alert to customers, we're getting a http 200 back for the endpoint but yet somehow our environment was still identified as being impacted by the change, we're trying to figure out how to mitigate any potential risk of having extensive failures across our solutions on the platform. 

[sachin_mathur]

Hi @ekutarnia 

As long as you are able to see 200's and are not seeing errors when following the instructions I shared above, you should not encounter any issues in accessing the Power Automate portal post migration to PPAPI.
Other network glitches and network latency related errors can contribute to the data we base our notifications on; to maintain customer trust, we were conservative in notifying customers where we saw any errors in accessing said URLs to ensure we minimize any possible disruption to business.

Regards

@sachin_mathur 

[v-rburgula]

Hi Sachin, Is there a new date when the changes are going to happen?

@sachin_mathur 

[sachin_mathur]

@v-rburgula I will share the up-to-date release timelines on Monday 03/25! 

Regards

@sachin_mathur 

[v-rburgula]

Hi Sachin, just following up to check for a date.

@sachin_mathur 

[sachin_mathur]

@v-rburgula sorry for the delay in my response! The feature deployment is planned starting mid-April. If there are any changes to this schedule, I will communicate them here on this thread.