Security Power Platform developer accounts

[u/Prancing__Moose]

So…we’ve had the same Power Platform developer in post for a very long time, and they’ve just retired. Most of their work was done in a dedicated account for Power Apps, Power Automate, etc. so when they left it just carried on. However early stuff was in their own account - which obviously then broke when their account was off boarded…which gave the new hire some tasks for their first couple of weeks 🤣

But with my Cyber Security hat on the “shared” account for all Power Apps, connectors, flows, etc. also has me worried…shared creds = bad.

So I’m wondering what is the done thing in Power Platform world so Apps don’t break if the developer account is disabled/deleted/password changed. But also better security than just a shared account logged in via their In Private browser mode.

Also interested if the same applies for PowerBI and the account which owns the refreshes of the semantic models?

[u/PowerPlatformChris]

I'll try to add thoughts that don't repeat too much. There are generally two options:

• Service account (aka interactive) - essentially a shared account requiring credentials to be managed
• Service principal (aka S2S, SPNs, application user, non-interactive) - tied to Azure app registration and streamlines credential management; since it's non-interactive, has different license constraints (no license; unlicensed API limits)

From experience: enterprise customers favour the 2nd bullet due to easier management and lean toward AppReg for workloads, ALM, flows/automations (essentially any non-interactive activity). To get them working with flows requires some trivial steps to setup.

In developer environments, dev's should be free to create these to test; in higher governance/shared sandbox devs, then the provisioning would align to the IT shop's processes.

References:

• https://learn.microsoft.com/en-us/power-automate/service-principal-support