Managing who can create Flow & PowerApps for our sharepoint lists

Question

We have a classic team site collection inside our sharepoint online tenant. and i am trying to prevent contributor users from creating PowerApps and Flow for the sharepoint lists. For example we have a custom list, and when i access the site using the sharepoint admin, i got the options to create PowerApp & Flow, as follow:-

while when i access the site using a contributor user, seems the PowerApp option will be missing but the ability to create Flow will be there, as follow:-

so can anyone advice on these 2 points please:-

1. Which setting inside our office 365 prevented contributor users from creating PowerApp for the sharepoint lists?

2. Can we also prevent contributor users from creating Flow? as in the current settings, contributor users can create Flow which will affect all the users using the list.

Thanks

Answer 1

1. The permission. Because the user does not have the enough permission in the list, then the user cannot create the PowerApps in the list.

2. If you grant the user with Read permission, then you can prevent the user from creating Flow or PowerApps in the list.

Answer 2

The answer marked as correct is not quite correct. Granting a user read permission (and not contribute) will indeed make it so that creating flows from the list is not available. However, a read-only user will still be able to create a flow directly from the flow site.

Steps:

1. Log into a site where you have read access.
2. Verify that the options to create a flow do not exist on any list/library
3. Navigate to flow.microsoft.com
4. Create a new flow, using the SharePoint:"When an item is created or modified" trigger
5. Enter the site url and list name where you have read access into the trigger fields
6. Enjoy your new flow!

To make this a bit more entertaining:

1. Sign in to a completely different O365 tenant (tenantB)
2. create a new flow, using the same trigger as above
3. change the connection to use the original account (in tenantA) (the account that has read access)
4. Proceed as before

You now have a flow running in tenantB that uses your TenantA account to access a list in TenantA where you have read access. This flow exists in TenantB, and so admins in TenantA have no visibility or control over it. This also means that the DLP policies configured in TenantA's flow admin center don't apply.