Shared Connection - Account?

[Delid4ve]

So I create a flow, say to send an approval email (not approval process but email with options) from powerapps.

On the action i choose the account (Outlook connection)

The App is shared.

User logs in and activates the flow.

Email is sent from their own account..

Ive specified an account in the flow action setting so why is it sending the email from the users account??

[v-yuazh-msft]

Hi @ Delid4ve,

Could you please share a screenshot of the configuration of your flow?

Could you please share a screenshot of the approval email?

Do you mean you have created a flow which use yourselves connection in the "Start an approval" action and share the flow with other users,and however,when the user run the flow, the email is always be sent from the user's account?

I have made a test on my side and the issue is confirmed on my side,the  email is always be sent from the user's account who runs the flow.

And I have find that when share the flow with others, if the user runs the flow,an email would be sent say that the user have modify the flow as screenshot below:

May be there is something changed in the flow approval and the approval would always be send by the one who runs the flow.

If you want the run always sent by you, please submit an idea to Flow Ideas Forum:

https://powerusers.microsoft.com/t5/Flow-Ideas/idb-p/FlowIdeas

Regards,
Alice Zhang

[Delid4ve]

@v-yuazh-msft I can give scenarios to this issue:

Flow A:

Scenario: Runs on a sharepoint created item trigger, send email with options.

Result: Email is sent from the account selected under My Connections

Flow B:

Scenario: Runs on powerapps trigger, send email with options, User has SendAs permissions on the account selected under My Connections

Result: Email is sent from the account selected under My Connections

Flow C:

Scenario: Runs on powerapps trigger, send email with options, User has NO SendAs permissions on the account selected under My Connections

Result: Email is sent from the users account and NOT the account selected under My Connections

Conclusion:

This really hasnt been thought about.

A: The flow should ALWAYS send from the account specified under My Connection

B: Granting the user SendAS permission on a mailbox creates serious security issue

C: Allowing the flow to send the email from the users own account gives them access to the sent mail with the buttons present to select an option, before it even gets delivered. (We are using the options to send a document to a choice of people, the user should not have access to this information creating a serious security issue.

There is a major design flaw here which creates huge security risks.  The whole point of specifying the account in the shared connection is so the flow uses it, yet it just ignores it.

[Delid4ve]

Images of the flow

Flow quite clearly says the ser***** connection yet the user logs into the app and it changes to their account eng*****