Forum Discussion
Best practices for Power Automate with service account
- Create new Flows or import existing Flows into the Service Account
- Share the Flows with the Authors (so they can update the Flows from their own account but it continues to run as the Service Account)
- email will come from the Service Accounts email address
- Seems risky allowing users create arbitrary flows that will run under an account with likely a lot of access/privileges no?
- Hi Steve - Does this make it so you can provide the SA limited access, but the users the flow is shared with account is what is used to connect the tools?
SteveKnutson In our security training we are instructed to never login using a service account. Is it my understanding that when you set up a Power Automate workflow you should use a service account and sign in using the service account? Sorry, I am new to all of this and trying to understand. We had a training yesterday with Microsoft and one of our people came unhinged when they suggested using a Service Account to set up our workflows. Can you explain to me how this would NOT be a security risk?
Sharon_Sproul it is important to restrict who has access to the 'Service Account', if you create a Flow it can be exported and then imported into the 'Service Account' (someone has to login as the account to do this. It can have MFA). Once imported you can Share the Flow with the author who can make updates. It isn't perfect. See the reply from LimeLeaf above.
- I've read here https://docs.microsoft.com/en-us/power-automate/change-cloud-flow-owner?WT.mc_id=M365-MVP-9698
that going with service account to run flow requires us to acquire and assign per flow license. Is it correct?- As I understand it, yes 1 per flow license is required for each flow running under a service account.
SteveKnutson I disagree here, Steve.
The article states:
"The service account is used by many users. In this case, it is recommended to assign a per flow license to the flow to ensure any new users adding to the account are automatically compliant."
(Source: https://docs.microsoft.com/en-us/power-platform/admin/power-automate-licensing/faqs#i-have-multiple-flows-running-under-a-shared-service-account-what-licenses-do-i-needIt looks like a recommendation to make Microsoft licence compliance easier but it doesn't seem like a strict functional requirement that will block you.
Meaning that it shouldn't break your flows if you don't follow it, it seems to be worded as a recommendation, not a rule.
But I might be wrong, haven't traversed this yet. Keen to hear from someone who actually went down this path and has a solution in production that goes through this scenario
