Checking user-owned Power Automate flows (offboarding audit)

Source: Claude.ai chat (original: checking-user-owned-power-automate-flows__12252967.md) Added: 2026-10-02

Summary

• Dataverse workflows queries only return solution-aware flows (category eq 5). Personal / default-environment flows never appear.
• The authoritative audit is Get-AdminFlow from Microsoft.PowerApps.Administration.PowerShell — covers every cloud flow tenant-wide; pair with Get-AdminFlowOwnerRole to surface co-owners (not just the creator).
• Flow ownership lives in the Flow service, not Dataverse. Impersonation (MSCRMCallerID) does not reach Flow — it only narrows Dataverse views, so impersonation is the wrong tool for asset discovery.

Key takeaways

• Get-AdminFlow -CreatedBy takes an Entra object ID, not a systemuserid. Bridge via systemusers?$select=azureactivedirectoryobjectid&$filter=systemuserid eq {guid}.
• CreatedBy ≠ Owner. Reassigning the creator does not remove co-owners. Only Get-AdminFlowOwnerRole surfaces the full owner list.
• Set-AdminFlowOwnerRole adds, doesn't replace. Follow with Remove-AdminFlowOwnerRole for the leaver. Connections stay bound to the original creator regardless of ownership and will break on account deletion.
• For solution-aware cross-check: $filter=category eq 5 and statecode eq 1 + $expand=ownerid($select=fullname,domainname,azureactivedirectoryobjectid) — the AAD object id joins the two datasets.
• For "created by that user," use _createdby_value (immutable). Running _ownerid_value and _createdby_value and union-ing gives the complete offboarding picture.

Learnings / how to apply

• Build a reusable Offboarding Audit script (PowerShell, device-code login, timestamped CSVs per output) as a Praxisis Sustain Operating Model asset.
• Audit scope should always include flows + appmodules + customapis + solutions queried by both ownerid and createdby.
• Document the "connections survive the user" trap in any D365 sustainment playbook — it's a silent production breaker during leaver cycles.

---