Flowstudio Power Automate Governance

Power Automate Governance with FlowStudio MCP

Classify, tag, and govern Power Automate flows at scale through the FlowStudio MCP cached store — without Dataverse, without the CoE Starter Kit, and without the Power Automate portal.

This skill uses the same store_* tool family as flowstudio-power-automate-monitoring, but with a different intent: governance writes metadata (update_store_flow) and reads for audit and classification outcomes. Monitoring reads the same tools for operational health outcomes. Don't try to memorize which skill "owns" which tool — pick by what the user is doing. For health checks and failure-rate dashboards, load flowstudio-power-automate-monitoring instead.

⚠️ Pro+ subscription required. This skill calls store_* tools that only work for FlowStudio for Teams or MCP Pro+ subscribers. If the user does not have Pro+ access: the first store_* tool call will return a 403/404 error. When that happens: 1. STOP calling store tools 2. Tell the user governance features require a Pro+ subscription 3. Link them to https://mcp.flowstudio.app/pricing Discovery: load tool schemas via the meta-tools rather than tools/list — call tool_search with query: "skill:governance" for the canonical bundle, or query: "select:update_store_flow" for a single tool. This skill covers workflow patterns and field semantics — things tool_search cannot tell you. If this document disagrees with a real API response, the API wins.

Critical: How to Extract Flow IDs

list_store_flows returns id in format <environmentId>.<flowId>. You must split on the first `.` to get environmentName and flowName for all other tools:

id = "Default-<envGuid>.<flowGuid>"
environmentName = "Default-<envGuid>"    (everything before first ".")
flowName = "<flowGuid>"                  (everything after first ".")

Also: skip entries that have no displayName or have state=Deleted — these are sparse records or flows that no longer exist in Power Automate. If a deleted flow has monitor=true, suggest disabling monitoring (update_store_flow with monitor=false) to free up a monitoring slot (standard plan includes 20).

The Write Tool: update_store_flow

update_store_flow writes governance metadata to the FlowStudio cache only — it does NOT modify the flow in Power Automate. These fields are not visible via get_live_flow or the PA portal. They exist only in the FlowStudio store and are used by FlowStudio's scanning pipeline and notification rules.

This means:

• ownerTeam / supportEmail — sets who FlowStudio considers the governance contact. Does NOT change the actual PA flow owner.
• rule_notify_email — sets who receives FlowStudio failure/missing-run notifications. Does NOT change Microsoft's built-in flow failure alerts.
• monitor / critical / businessImpact — FlowStudio classification only. Power Automate has no equivalent fields.

Merge semantics — only fields you provide are updated. Returns the full updated record (same shape as get_store_flow).

Required parameters: environmentName, flowName. All other fields optional.

Settable Fields

Caution with `security`: The security field on get_store_flow contains structured JSON (e.g. {"triggerRequestAuthenticationType":"All"}). Writing a plain string like "reviewed" will overwrite this. To mark a flow as security-reviewed, use tags instead.

Governance Workflows

1. Compliance Detail Review

Identify flows missing required governance metadata.

1. Ask the user which compliance fields they require
2. list_store_flows
3. For each active flow: split id, call get_store_flow, check required fields
4. Report non-compliant flows with missing fields listed
5. For updates: ask for values, then update_store_flow(...provided fields)

Common compliance fields: description, businessImpact, businessJustification, ownerTeam, supportEmail, monitor, rule_notify_onfail, critical. Ask for the user's policy before flagging.

2. Orphaned Resource Detection

Find flows owned by deleted or disabled Azure AD accounts.

1. list_store_makers
2. Filter where deleted=true AND ownerFlowCount > 0
3. list_store_flows → collect all flows
4. For each active flow: split id, get_store_flow, parse owners JSON
5. Match owner principalId against orphaned maker id
6. Reassign governance contact or stop/tag for decommission

update_store_flow does not transfer actual PA ownership; use the admin center or PowerShell for that. Some orphaned-looking flows are system-generated; tag them instead of reassigning when appropriate. Store coverage is only as fresh as the latest scan.

3. Archive Score Calculation

Compute an inactivity score (0-7) per flow to identify cleanup candidates.

1. list_store_flows
2. For each active flow: split id, get_store_flow
3. Add 1 point each: created≈modified, test/demo/temp/copy name, age >12mo,
   stopped/suspended, no owners, no recent runs, complexity.actions < 5
4. Score 5-7: recommend archive; 3-4: tag #archive-review; 0-2: active
5. For confirmed archive: set_live_flow_state(..., "Stopped") and append #archived

Archive via MCP means stop the flow and tag it. Deletion requires the portal or admin PowerShell.

4. Connector Audit

Audit which connectors are in use across monitored flows. Useful for DLP impact analysis and premium license planning.

1. list_store_flows(monitor=true)
2. For each active flow: split id, get_store_flow, parse connections JSON
3. Group by apiName; flag Premium tier, HTTP connectors, custom connectors
4. Report inventory to user

Scope to monitored flows where possible; each get_store_flow call costs time. list_store_connections lists connection instances, not connector usage per flow. DLP policies are not exposed; ask the user for connector classifications.

5. Notification Rule Management

Configure monitoring and alerting for flows at scale.

Enable failure alerts on all critical flows:
1. list_store_flows(monitor=true)
2. For each active flow: split id, get_store_flow
3. If critical=true and rule_notify_onfail is false, update_store_flow(...,
   rule_notify_onfail=true, rule_notify_email="oncall@contoso.com")

Enable missing-run detection for scheduled flows:
1. list_store_flows(monitor=true)
2. For active Recurrence flows: get_store_flow
3. If rule_notify_onmissingdays is 0/missing, update_store_flow(...,
   rule_notify_onmissingdays=2)

Check monitoring limits before bulk-enabling monitor=true. If no flows have critical=true, report that as a governance gap before configuring alerts.

6. Classification and Tagging

Bulk-classify flows by connector type, business function, or risk level.

Auto-tag by connector:
1. list_store_flows