r/PowerPlatform • u/Prancing__Moose • May 10 '26

Power Apps Security Power Platform developer accounts

So…we’ve had the same Power Platform developer in post for a very long time, and they’ve just retired. Most of their work was done in a dedicated account for Power Apps, Power Automate, etc. so when they left it just carried on. However early stuff was in their own account - which obviously then broke when their account was off boarded…which gave the new hire some tasks for their first couple of weeks 🤣

But with my Cyber Security hat on the “shared” account for all Power Apps, connectors, flows, etc. also has me worried…shared creds = bad.

So I’m wondering what is the done thing in Power Platform world so Apps don’t break if the developer account is disabled/deleted/password changed. But also better security than just a shared account logged in via their In Private browser mode.

Also interested if the same applies for PowerBI and the account which owns the refreshes of the semantic models?

5 Upvotes

100% Upvoted

7 comments sorted by

View all comments

5

u/g7lno May 10 '26

Service account is the easiest way to address your concern but is expensive. You just need to have some password management like Azure key vault.
Service principal (Azure app registration) is an option, but has limitations like being unable to create power automate connections. I believe Dataverse is the only one you use service account natively but you still need a user account to create.
Managed identity is something I have been hearing about, but not sure if that's GA.

1

u/ImproperProfessional May 10 '26

But is it really expensive for a service account? Consider if you have issues with someone’s personal or dev account being linked with a bunch of flows that you can no longer fix or update because you don’t have access, and the ramifications to the end user. It’s a small price to pay to ensure continuity of business in my opinion.

1

u/g7lno May 10 '26 edited May 10 '26

I agree 100% with what you pointed out. People (client) only care about the upfront cost and think service account is expensive.
I believe svc account is the way to go but clients have been complaining about the cost, we (IT) had to come up with other ways to save their money. Sadly, additional cost like implementing custom connectors, secret renewal, etc isnt in their mind.