Managed solution with Connection References and Service Principal connections

[Helpful]

Hi All,

I'm finding the scenario below harder than I think it should be and I'm wondering if I'm missing something.  Please weigh-in with any insights.

Assume two environments in the same tenant: DEV (unmanaged solution environment) and TEST (managed):

• Create and configure a new Application User for use in both environments - call it "SPN Flow Execution"
• In DEV, create a new unmanaged solution - call it "Demo Solution"
  • Add a Flow to the solution - call it "Demo Flow"
    • Trigger:
      • "When a record is selected"
      • Create a new SPN-based connection to Common Data Service - call it "DEV SPN CDS Connection"
      • Account entity or whatever you like
    • Action:
      • "Create a new record"
      • Create a new SPN-based connection to Common Data Service (current environment) - call it "DEV SPN CDS (current) Connection"
      • Create a new Account and add static values for required fields
  • Add a Connection Reference (preview) to the solution - call it "Demo CDS Connection"
    • Connector: Common Data Service
    • Connection: DEV SPN CDS Connection
  • Add another Connection Reference (preview) to the solution - call it "Demo CDS (current) Connection"
    • Connector: Common Data Service (current environment)
    • Connection: DEV SPN CDS (current) Connection
  • Update Flow Trigger and Action to use appropriate Connection References
  • Publish and export solution as managed

In TEST, import solution and see where things start to break down...

When deploying to TEST:

The import process wants the user to associate the Connection References included in the solution with local connections.  At this point, I would expect to be able to create a new connection using the SPN I setup in the environment, however, only user-based connections are displayed and only user-based connections can be created using the "+ New connection" button.

In a given environment, an admin is unable to create an SPN-based connection outside the context of a Flow.  Prior to attempting a solution import I can't go into TEST, navigate to Data -> Connections -> "+ New connection" and create SPN-based connections that will then be associated with the Connection References.

Furthermore, I can't create a quick Flow in test to establish the two new environment-specific connections (e.g. "TEST SPN CDS Connection" and "TEST SPN CDS (current) Connection") and then go back to the solution import UI to refresh the list and choose one.  Hitting refresh and they never show up.

Anyone from the engineering team that can shed some light on the expected deployment scenario here?

[Helpful]

Small update...  Instead of using my existing TEST environment I created a fresh TRIAL environment and basically followed the same steps above.

Some observations:

• Prior to attempting to importing the solution, I created a new local flow (didn't have to save it) with two SPN-based connections: "TRIAL SPN CDS Connection" and "TRIAL SPN CDS (current) Connection".
• I then imported the solution and was prompted by the UI to associate the Connection References with a local connection and the new local connections appeared in the list.
• The flows did not activate upon import which I don't fully understand since they were associated with the valid connections.  I had to open them and click "Continue", Save and then Activate.

I assume that the TEST environment I had been using was in a state that the new connection reference/import process does not like... hopefully things get ironed out soon.  It will be nice to have this process work without having to troubleshoot issues.

Also, existing ALM deployments from Azure DevOps are not in a good place due to connection references, but this has been well-documented in the forums.

[Aedu]

Hi

I just stumbled about this behavior and, thanks to your article, am confirmed in my understanding of how Connection References work.
I think your solution is good. Of course I hope that Microsoft will come up with a solution how to set up a connection with a SPN during the solution import or in general without having to create a dummy flow. I personally don't like such tinkering in managed environments. They contradict the managed idea.

I calm myself with the knowledge that we are still working with "latest **bleep**" technologies here.

Is it as it is or do we things completely wrong?

Regards

Adrian

[smadep]

I just stumbled over the same thing - still only possible to (pre-)create a connection to dataverse using SPN from within flow. And then fix the connection reference manually after deployment.

As this option is available in flow I'm just wondering why it is still not available through outside connection UI ... work in progress, ok, but 2 years?! either it's meant to be possible or not ...

This makes ALM so much more complicated - again manual intervention necessary.

Is there a pac command?!

[Tommygee]

I am having the same issue...there surely must be a way to do this without having to do all of this pre-deployment steps!? 

[piotr-albertin]

Let me know if you find one 🙂

[hjaf]

I found it hard to search for documentation as well as similar issues, perhaps because of the ambiguous terms "connector"/"connections". 

Some documentation regarding desktop flows suggests that this is not doable through the GUI, but considering they have established GUI functionality for creating service principal connections from within power automate "studio", it is really strange (and confusing for users) they have not extended this to the connection section as well.

I would like this to be covered in this section of the documentation:
https://learn.microsoft.com/en-us/power-apps/maker/data-platform/create-connection-reference
I guess the only thing we can do is suggest improvements to the documentation for clarification.

There are some feedback from other people finding the documentation difficult to understand:
https://github.com/MicrosoftDocs/powerapps-docs/issues/4248 

But considering this was assigned to some author over a year ago and still left open, makes me think that there will be significant changes to this soon.. or its not a priority to document the more complex parts of the platform..