Dataverse Service Account Secret Setup
6 min
blueprint analyze/alc imports flowsession data — flow runs and execution traces — from your dataverse environment using a service principal with a custom security role that role grants organization level read access to the flowsession , process (workflow) , desktopflowbinary , and systemuser tables ⚠️ complete the following before starting an azure ad app ("pad export") must already be registered and configured for power platform access see azure app registration (power automate desktop) docid\ nh5ewqt ytyeus9nwbg7n for details your dataverse environment must have action log uploads enabled (on by default) see microsoft documentation https //learn microsoft com/en us/power automate/desktop flows/governance#prevent power automate for desktop from uploading action logs after a desktop flow execution each desktop flow run supports up to 32 mb of action logs ( 50k–80k entries) split long flows if you exceed this limit a service principal with a custom security role is required with read access to the following tables flowsession process (workflow) desktopflowbinary systemuser step 1 create a power platform security role in the power platform admin center https //admin powerplatform microsoft com/home , select the target environment configured in your blueprint pad export settings select settings in the toolbar navigate to users + permissions > security roles click new role in the toolbar name and configure the new role, then click save in the tables filter, select show all tables and search for flowsession in the flow session row, click none in the read column and select organization search for the process (workflow) table and set the read column permission to organization search for desktopflowbinary and set the read column permission to organization search for systemuser and set the read column permission to organization click save and close step 2 create an application user in the same environment settings, navigate to users + permissions > application users click new app user , then click add an app search for and select your pre registered pad export azure ad app, then click add click the security roles pencil icon, select the role created in step 1, then click save click create step 3 generate and configure the service account secret in azure ad, open your pad export app and create a new client secret copy the value of the generated secret — not the secret id in blueprint, go to settings > rpa management > analyze , enable dataverse synchronization , and paste the value into the service account secret field click save your service account is now configured for dataverse based flow imports