{"id":110971,"date":"2018-08-23T10:52:12","date_gmt":"2018-08-23T17:52:12","guid":{"rendered":""},"modified":"2025-06-11T08:07:15","modified_gmt":"2025-06-11T15:07:15","slug":"automate-flow-governance","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/power-platform\/blog\/power-automate\/automate-flow-governance\/","title":{"rendered":"Advanced | Flow of the Week: Automating Microsoft Flow Governance – Using Microsoft Flow"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

Enterprise Security and Governance is an important topic for many organizations. Microsoft continues to make investments that allow customers to implement PowerApps and Flow and be confident that they have their bases covered from a governance perspective. Much like Microsoft Flow empowers users to build powerful workflow and automation solutions, we want to empower administrators with the same capabilities to support their needs. In this blog post we are going to explore a scenario that describes how you can automate governance activities by taking advantage of the Office 365 Management API.<\/p>\n

Overview<\/strong><\/p>\n

A scenario that we will walk through in this post is the ability to detect when specific events exist within a flow definition so that we can detect these events and provide pro-active governance against it. For example, some organizations would like to avoid users forwarding emails externally. Microsoft Exchange can block these scenarios through transport rules. But, using cloud workflow tools (including more than just Flow) you generally break down these actions into more discrete events. For example, I can receive an email and send an email within the same flow. Independently, these actions may not be perceived as forwarding an email, but from a functional perspective, they achieve the same result.<\/p>\n

In order to detect these events, we will depend upon the Office 365 Security and Compliance logs which will capture events related to creating, editing or deleting a flow. In a previous blog post<\/a>, we discussed how we can poll the Office 365 Security and Compliance PowerShell Webservice looking for these events. In this blog post, we are going to use an event-driven approach where we will create a webhook and have events sent to a Microsoft Flow endpoint. Once Microsoft Flow receives this event, we will go fetch additional details of the event. We will then parse these events and perform some logic to determine if a condition exists that warrants action, including stopping the flow that is a concern.<\/p>\n

\"\"<\/p>\n

Pre-requisites<\/strong><\/p>\n

In this blogpost, we will be interacting with the Office 365 Management API and the Microsoft Flow Management connector. As a result, there are specific requirements for accessing these capabilities:<\/p>\n\n\n\n\n
\n

Office 365 Management API<\/strong><\/p>\n<\/td>\n

\n
    \n
  • Global Administrator Access<\/li>\n
  • Azure AD Application<\/li>\n
  • Get Office 365 tenant admin consent<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
\n

Flow Management Connector<\/strong><\/p>\n<\/td>\n

\n