How to make a flow run as a run only user

Configure the flow’s SharePoint action to use the service account connection, then assign the app users as run-only users without allowing them to provide their own SharePoint connection.

Configure the flow

1. Sign in to Power Automate with the service account that owns the flow.
2. Select My flows, then open the instant cloud flow’s details page rather than the flow designer.
3. Under Run only users, select Edit.
4. Add the Microsoft Entra group containing the canvas-app users.
5. In the connection section, locate SharePoint and select the existing service-account connection—not Provided by run-only user.
6. Select Save.

Power Apps-triggered instant flows support this configuration. Run-only users can trigger the flow but cannot edit it or view its run history, and the owner can choose between the caller’s connection and a connection already defined in the flow.^1^ When the predefined connection is selected, SharePoint operations execute using that connection’s identity rather than requiring the caller’s SharePoint permissions.^2^

Verify the SharePoint action connection

Edit the flow and inspect the Create item action:

1. Select the action’s … menu.
2. Confirm that its connection is the service account’s SharePoint connection.
3. If necessary, select Add new connection, authenticate as the service account, and select that connection.
4. Save the flow, return to its details page, and confirm that the same connection is selected under Run only users.^1^

The flow can still identify the person who invoked it through trigger information, but that does not mean the Create item action is using that person’s SharePoint connection. The connector selection in Manage run-only permissions controls which identity the SharePoint action uses.

If “Run only users” is not visible

The card appears only for triggers that support run-only users and is located below Owners on the flow details page.^3^

Because Power Apps (V2) is an instant-flow trigger, open the flow directly in Power Automate, not only through the embedded Power Apps flow editor. Also confirm that the signed-in account is the flow’s creator or owner; only an owner can manage sharing.^1^

Keep SharePoint inaccessible to app users

Do not add the SharePoint list itself as a data source in the canvas app. SharePoint uses each canvas-app user’s Microsoft Entra identity, so a direct SharePoint connection requires that user to have access to the underlying data.^4^

Instead:

• Pass only the submitted field values from the app to YourFlow.Run(...).
• Perform all SharePoint reads and writes inside the flow using the service-account connection.
• Do not grant the group permission to the site or list.
• Validate all values received from Power Apps before writing them, because users can invoke the flow with the exposed input parameters.
• Avoid returning sensitive SharePoint data through Respond to a PowerApp or flow.

After changing the flow or its app integration, save and publish the canvas app so users receive the current version.^5^

References

1. Share a cloud flow
2. Guide to cloud flow sharing and permissions
3. Manage owners and users in your Microsoft list flows with Power Automate
4. Overview of connectors for canvas apps
5. Share a canvas app with your organization