Dataverse Service Account Secret Setup

Updated by Sean Ellner

IMPORTANT Pre-Requisites:
1. An Azure AD app (“PAD Export”) already registered and configured for PowerPlatform access.

2. Your Dataverse environment must have action-log uploads enabled (default on).

3. Each desktop flow run supports up to 32 MB of action logs (~50K–80K entries). Split long flows if you exceed this limit.

4. A Service Principal/Account with a custom security role is required to read the following tables for all desktop flows:
- flowsession
- process (workflow)
- desktopflowbinary
- systemuser

For details on registering your Azure AD app, see Azure App Registration (Power Automate Export).

Analyze imports flowsession data (flow runs and traces) across your Dataverse environment by leveraging a Service Principal with a custom security role that grants Organization-level read access to the flowsession table. That role must also include read permissions on the process (workflow), desktopflowbinary, and systemuser tables. The Service Principal connects to the Dataverse environment specified in your PAD Export instance settings.

Create Power Platform Role

  1. In the Power Platform Admin Center, select the target environment (configured in Blueprint PAD export)
  1. Select Settings in the Toolbar
  1. Navigate to User + Permissions -> Security Roles
  1. Click New Role in the toolbar
  1. Create new role, update, and Save
  1. Select Show All Tables (in the tables filter) and search for flowsession
  1. Click on None value in the Read column for Flow Session row (Custom Table) and select Organization in the dropdown
  1. Search for process (workflow) table and change Read column permission to Organization
  2. Search for desktopflowbinary table and change Read column permission to Organization
  3. Search for systemuser table and change Read column permission to Organization
  4. Click Save and Close in the toolbar

Create Application User

  1. In the same environment settings, navigate to Users + Permissions -> Application Users
  1. Click New App User (add application user) and then Add an App

 

  1. Search for and select your pre-registered PAD Export Azure AD app and click Add
  2. Click on Security Roles (pencil icon) and select role created in the first section. Click Save
  1. Click Create

Generate and Set Service Account Secret

  1. In Azure AD, open your PAD Export app and create a New Client Secret
  1. Copy the Value of the generated secret (not the secret ID)
  1. In Blueprint, go to Settings -> RPA Management -> Analyze, enable Dataverse Synchronization, and paste the Value (not the secret ID) into the Service Account Secret field
  1. Click Save

Your service account is now configured for Dataverse-based flow imports.

How did we do?