Microsoft Power Automate HTTP Trigger and Restricting Users

HTTP triggers can be secured using various authentication mechanisms to ensure the security and privacy of your workflows. However, MS just recently began rolling out a new feature that will simplify authentication! It’s not yet available in all regions, so stay tuned if you don’t see it yet in your tenant.

Restricting what users can trigger the flow

This new feature (available with new Http triggers) allows admins to restrict what users (or apps) can trigger the flow. When you first create the “When a HTTP request is received” trigger, you now have an option called “Who can trigger the flow?”. The options for this are:

• Any user in my tenant
• Specific users in my tenant (users or service principal object ids)
• Anyone

The option you choose will depend on your use case, but most cases will benefit from the first option, “Any user in my tenant”.

Allowing external apps to trigger the flow

If you need an external service or app to trigger the flow, your admin should create an App Registration in your Azure Tenant for them to use. The settings required for the App Registration are:

• Add API permissions: Power Automate User.Read . Be sure to grant admin consent for this
• Add claims as outlined here
• Create a secret and provide the value, Client Id, Tenant Id to the 3rd party

The 3rd party can then obtain an access token using OAuth 2.0 and a Grant Type of Client Credentials.  Access Token Url will be: https://login.microsoftonline.com/{{TenantID}}/oauth2/v2.0/token
Scope will be: https://service.flow.microsoft.com//.default

Common errors