Power Platform: Orphaned Flows & Apps, DLP Gaps
The question it answers: Which Power Automate flows and Power Apps belong to makers who left, and which environments have no DLP policy?
Power Automate flows and Power Apps built by staff run real business processes. When the maker leaves, their flows stop as soon as their connections expire - silently. Environments without a DLP policy let makers combine any connectors, and some connectors send data straight out of the tenant.
At a glance
Section titled “At a glance”| Where in the app | Tenant › Teams Voice, Power Platform & Copilot › Power Platform Governance |
| Workload | Tenant |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Power Platform (included in Microsoft 365 for standard connectors). |
| Report id (API and MCP) | tenant.collaboration.power-platform |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Object | Category | Text |
| Environment / flow / app | Subject | Link |
| Check | Setting | Text |
| DLP / owner | Value | Text |
| Finding | Finding | Text |
| Environment | Detail | Text |
| Modified | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Power Platform (included in Microsoft 365 for standard connectors).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
User.Read.All | Microsoft Graph | Read all users’ full profiles | owner state |
User-LifeCycleInfo.Read.All | Microsoft Graph | Read all users’ lifecycle information | with |
User.Read.All | Microsoft Graph | Read all users’ full profiles | with |
Roles and other setup:
- Power Platform management application registration of this app (no Graph permission)
Data sources it reads
GET https://api.bap.microsoft.com/.../scopes/admin/environmentsGET https://api.bap.microsoft.com/.../scopes/admin/apiPoliciesGET https://api.flow.microsoft.com/.../scopes/admin/environments/{env}/v2/flowsGET https://api.powerapps.com/.../scopes/admin/environments/{env}/appsGET /v1.0/users (cached)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/tenant.collaboration.power-platform?size=100An AI assistant reads it with the MCP tool get_report and the id tenant.collaboration.power-platform. The client needs the Read grant for Tenant. See Using the API.