Limiting the use of Azure AD Connector in Power Automate

[MarkPP]

Hi

I wanted to clarify something in regards to the Azure AD Connector in Power Automate. If users want to use this a Global admin (GA) needs to consent on behalf of the organisation. The privileges behind this connector are very high E.g. Group.ReadWrite.All, User.ReadWrite.All, Directory.ReadWrite.All. Therefore i absolutely don't want all users making use of this connector. I have read some articles around not consenting on behalf of the organisation and trying to grant access to individuals instead but it all seems a bit long winded. Therefore is the below the way to do this now?

A GA consents on behalf of the organisation for this connector and then goes to the underlying Enterprise Application "MSFT Power Platform - Azure AD" in Azure AD. In the properties for the Enterprise Application set User assignment required to Yes and then under the Users and groups add the limited number of people in there that you want to use the connector as per the picture below?

Thanks

[rimatos · Accepted solution]

Hi @MarkPP,

Yes, this would be one way to restrict users access to the application, since the users would need to be inserted in the group of that Enterprise application to access it.

However, in order for them to be able to access it you also need to make sure they have the correct roles assigned to them, since the connector only allows them to do actions to the same level they can do both in the UI and via REST API.

You have her a in depth guide on the different admin roles available. 

Additionally, you also have a article on how to achieve granular access to this connector here. 


Hope this information was useful!

Regards,

Ricardo

[ValentinMazhar]

Hello @MarkPP ,

I know that this thread is marked as resolved, and the methods to grant access of this connector to specific users work.

However I just thought it worth mentioning that the permissions granted to the App "MSFT Power Platform - Azure AD" are delegated. It means that even after a global admin has granted consent to the app, users will not be able to do anything with the connector that they are not already able to do of they connect to the Azure AD portal.

Hope it helps and clarifies!