Does creating a child flow that is called from an automated flow create a security hole inside our tenant

Question

We have a solution which contain 2 flows:

"SetPermission" is an instant flow which runs using the service account context,as follow:

While "WhenItemIsCreated" is an automated flow that runs when a list item is created, and this automated flow calls the

"SetPermision" workflow, as follow:

Now since the child flow "SetPermion" is an instant flow and it runs under the service account context (not the login user context), and since any user can reuse this child flow and call it from their own flows.

So does this poses a security problem? where users can call this child flow from their own flows, and perform actions they are not suppose to have permission on? and how we can secure calling this child flow?

Answer 1

If the child flow ("SetPermion") is not shared with any other account in your tenant, they cannot use it in their own flows.

Make sure the "SetPermion" flow is only shared with service account.

Follow below Microsoft official documentation for sharing cloud Power automate flows:

Share a cloud flow