Permissions between MS Flow and PowerApps

[avt]

Hello, 

I need help regarding data connection between ms flow and powerapps.

I have a powerapp for users, this app uses sharepoint, o365users, approvals, ms planner and office 365 connectors.

This app is shared with "can use" permissions (for users) , and my collague is an owner (I have "can edit" permission).

This powerapp uses users permission (I hope 🙂 ) for submiting info entered into form fields (gallery) into a Sharepoint list (this works nicely). While submiting, this powerapp button also starts a MS Flow.

This flow is not shared with users (I am the owner - but its a team flow - shared with my collague who is the powerapp owner) - it uses a powerapps trigger - this trigger passes 3 variables (title, id, createdBy) into the MS flow, I use these to determine the user manager, etc..

This Flow is used for approvals and notifications, based on these approvals this Flow changes the status collumn in the sharepoint list and my collague uses this status to filter the view in Powerapp.

The whole flow uses MY credentials.

BUT and this is the problem, it seems that the flow uses users credentials (user from powerapp) and thus I cannot use outlook365 send email from shared mailbox action - as this user does not have send on behalf or send as permission for this mailbox - and thus this flow FAILS at the send email from shared mailbox action 😞

After this we allowed our testing user to "send on behalf" shared mailbox (in exchange) - flow worked corectly.

My question is, is this a bug in the o365 outlook (send email from shared mailbox) action. OR am I misunderstanding the permission model between MS Flow and PowerApps AND if this is the case than how do we change the connection between MS Flow and PowerApps so the Flow runs only with my credentials?

best regards

[v-yuazh-msft]

Hi @ avt,

Could you please share a screenshot of the configuration of your flow?

Could you please share more details about the error that the user meet at the “send email from shared mailbox” action?

I have made a test on my side, and the issue is confirmed on my side.

When a create a flow with a “send email from shared mailbox” action, the whole flow uses my credentials.

If I share the flow with other user who does not have the permission for this shared mailbox, if the user run the flow, the “send email from shared mailbox” action would run failed with error “Specified folder not found” as screenshot below:

 

I would post this issue to my product team, if the issue is solved, I will reply here.

Regards,
Alice Zhang

[avt]

Hello,

thanks for trying to test it, but you used the wrong trigger, my flow is started with a powerapps trigger (started via a submit button in the powerapp itself) not a manually start a flow trigger.

thanks

[CaseyCotita]

Did you ever get this figured out? I have a similar PowerApp/Flow issue where end users don't have the permission to perform the File System drop part of the flow due to permissions, need some kind of handoff step...

[RFisch18]

Having same issue!

[CaseyCotita]

I actually figured out a way to make this work-

1) One flow for the PowerApp where the end user is able to use PowerApp data to create a file in Sharepoint in a folder they are given permission to add items to, so the end user only has to Allow the PowerApp to write/access Sharepoint.

2) Another separate flow using the Service Account's credentials/access looking for "When a file is created or modified" that copies the file from the previously mentioned Sharepoint location to the local server so that my Powershell file monitor can pick it up and run it.

Note that after having implemented the File System Flow into the PowerApp it took some deep digging in the PowerApp's Connector settings/details to root out that File System connector integration so it stopped asking end users to allow the permissions to use that connector and only ask to allow Sharepoint. 

[HelloThereAll]

Just to check, does this mean that a Flow initiated by PowerApps uses the user's credentials and not the owner's?  This is a question I myself have, as I want those who use the Flow through the PowerApp to be able to send data where they have access to even if I do not.