0

We have a solution which contain 2 flows:

johnjohn123_0-1688522688708.png

"SetPermission" is an instant flow which runs using the service account context,as follow:

johnjohn123_2-1688523024229.png

While "WhenItemIsCreated" is an automated flow that runs when a list item is created, and this automated flow calls the

"SetPermision" workflow, as follow:

johnjohn123_1-1688522802425.png

Now since the child flow "SetPermion" is an instant flow and it runs under the service account context (not the login user context), and since any user can reuse this child flow and call it from their own flows.

So does this poses a security problem? where users can call this child flow from their own flows, and perform actions they are not suppose to have permission on? and how we can secure calling this child flow?

4
  • 1
    Did you share the "SetPermision" flow with any other accounts than service account? If no, they will not be able to use it in their own flows. So, you should be good. Let me know if it answers your question. Jul 5, 2023 at 5:57
  • @GaneshSanap no i did not share it with any other use Jul 5, 2023 at 11:07
  • 1
    then they cannot use it in their own/other flows Jul 5, 2023 at 11:10
  • @GaneshSanap also they can not use the connection and they can not use the workflow , am i correct? Jul 5, 2023 at 11:12

1 Answer 1

1

If the child flow ("SetPermion") is not shared with any other account in your tenant, they cannot use it in their own flows.

Make sure the "SetPermion" flow is only shared with service account.

Follow below Microsoft official documentation for sharing cloud Power automate flows:

Share a cloud flow

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.