Przejdź do treści

Microsoft 365 (Power Platform) connector

What this connector reads

The Microsoft 365 connector enumerates Power Platform environments in your Microsoft Entra ID tenant. Each environment is a container for Power Apps, Power Automate flows, AI Builder models, and Copilot Studio bots. We list environment names, regions, types (Production / Sandbox / Default), and the principal who created them. Future iterations (Plan 15b in our roadmap) will enumerate the AI artefacts inside each environment; today the connector covers environments only.

This is an admin-consent OAuth flow against the Power Platform admin API. We do not call Microsoft Graph in this connector — a separate Azure connector handles Cognitive Services and Azure ML.

What you (the customer) need to do

You will need a global administrator in your Microsoft Entra ID tenant.

  1. In Secruna, open Connections → Connect M365. (screenshot placeholder TODO)
  2. You are redirected to login.microsoftonline.com. Sign in as the tenant admin.
  3. Microsoft displays the consent screen for the Power Platform admin scope. Review and click Accept. (screenshot placeholder TODO)
  4. You are redirected back to Secruna. The connection appears as active. The first environment list pulls within minutes.

The consenting admin must already be a Power Platform admin in your tenant for the underlying API to return data — admin consent authorises the OAuth grant, but the API itself enforces the Power Platform admin role.

Permissions / scopes requested

Scope Why we need it
https://service.powerapps.com//.default Power Platform admin API. We invoke GET /providers/Microsoft.BusinessAppPlatform/scopes/admin/environments?api-version=2020-10-01 to list environments.

/.default resolves at consent time to the admin-tier read permissions defined on the Power Apps Service resource (tenant.read.all, environment.read.all). We never call write endpoints.

What we do NOT touch

  • Power App contents. We do not enumerate apps, screens, controls, or formulas inside an environment.
  • Power Automate flow contents. We do not pull the JSON of flows, their triggers, or run histories.
  • AI Builder model artefacts (training data, custom models). Listing AI Builder is on our roadmap (Plan 15b) — when it ships we'll list metadata only.
  • Microsoft Entra ID directory. No user enumeration, no group membership reads.
  • Microsoft Graph. No mailbox content, no SharePoint sites, no OneDrive files, no Teams messages. Graph access requires separate consent.
  • Dataverse contents. We do not query the Dataverse data layer inside an environment.

How to revoke access

  1. In Microsoft Entra admin center → Enterprise applications, find Secruna (or whatever name we registered our M365 app under — confirm in your contract). Either delete the application or revoke user/admin consent.
  2. In Secruna, open Connections and click Disconnect on the M365 row.
  3. Within 90 days every artefact collected through this connection is purged. See data retention policy.

The Azure connector and the M365 connector use different enterprise app registrations. Revoking one does not affect the other.

Troubleshooting

Error you see Likely cause Fix
AADSTS65001: ... has not consented Non-admin tried to consent. Use a tenant admin account.
Connection active but environments list is empty The consenting admin is not a Power Platform admin (the OAuth grant succeeded but the API returns 403/empty). Grant the admin the Power Platform admin role in the Microsoft 365 admin center, then retry discovery.
403 Forbidden from bap.microsoft.com The tenant has no Power Platform deployment, or your tenant region routes a different URL. If the tenant doesn't use Power Platform at all, you can simply not connect this connector. If you do use Power Platform, contact support; some sovereign cloud regions need the API base URL adjusted.