--- title: Dataverse Service Account Secret Setup slug: blueprint/dataverse-service-account-secret-setup docTags: kEeQ6vT7FPx-7PjzNcWzO,oum8q4bc0upaPf1EXLYNr createdAt: 2026-04-17T18:28:54.123Z --- :::CtaButton{label="🔵 ALC" openInNewTab="false"} ::: Blueprint imports **flowsession **data — flow runs and execution traces — from your Dataverse environment using a Service Principal with a custom security role. That role grants Organization-level read access to the **flowsession**, **process (workflow)**, **desktopflowbinary**, and **systemuser **tables. *** :::hint{type="danger"} # ⚠️ Required Setup: Complete Before Using ALC 1. An Azure AD app ("PAD Export") must already be registered and configured for Power Platform access. See [Azure App Registration (Power Automate Desktop)](docId\:Nh5EWQt-YtYEUs9nWBg7N) for details. 2. Your Dataverse environment must have action-log uploads enabled (on by default). See [Microsoft documentation.](https://learn.microsoft.com/en-us/power-automate/desktop-flows/governance#prevent-power-automate-for-desktop-from-uploading-action-logs-after-a-desktop-flow-execution) 3. Each desktop flow run supports up to 32 MB of action logs (\~50K–80K entries). Split long flows if you exceed this limit. 4. A Service Principal with a custom security role is required with read access to the following tables: - **flowsession** - **process (workflow)** - **desktopflowbinary** - **systemuser** ::: *** :::::ExpandableHeading{isOpen="true"} ## Step 1: Create a Power Platform Security Role ::::WorkflowBlock :::WorkflowBlockItem In the [Power Platform Admin Center](https://admin.powerplatform.microsoft.com/home), select the target environment configured in your Blueprint PAD export settings ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/ZiZ3-MIZGezFcwQVAdJIx_image-1755084670235.png" size="50" width="522" height="338" position="flex-start" darkWidth="522" darkHeight="338" showCaption="false"} ::: :::WorkflowBlockItem Select **Settings** in the toolbar ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/7NHg6d3UtJwIQMQzHmsok_image-1729094712839.png" size="50" width="1820" height="858" position="flex-start" darkWidth="1820" darkHeight="858" showCaption="false"} ::: :::WorkflowBlockItem Navigate to **Users + Permissions** > **Security Roles** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/8Kta5ggFpXmFP5dafDh-7_image-1729094767585.png" size="50" width="1388" height="1125" position="flex-start" darkWidth="1388" darkHeight="1125" showCaption="false"} ::: :::WorkflowBlockItem Click **New Role** in the toolbar ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/cc4KGOevHGD93_ZwpE0_a_image-1729094827721.png" size="50" width="2209" height="707" position="flex-start" darkWidth="2209" darkHeight="707" showCaption="false"} ::: :::WorkflowBlockItem Name and configure the new role, then click **Save** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/QRwpkqrPyhO0sFf0FCqFe_image-1728587385982.png" size="50" width="517" height="456" position="flex-start" darkWidth="517" darkHeight="456" showCaption="false"} ::: :::WorkflowBlockItem In the tables filter, select **Show All Tables** and search for **flowsession** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/r5vZTrQ1rmuFpU2VhW0h9_image-1729095087461.png" size="50" width="2035" height="767" position="flex-start" darkWidth="2035" darkHeight="767" showCaption="false"} ::: :::WorkflowBlockItem In the **Flow Session** row, click **None** in the Read column and select **Organization** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/BtdBeEPS5LgL65c65I5xg_image-1729095217510.png" size="50" width="2330" height="670" darkWidth="2330" darkHeight="670" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Search for the **process (workflow)** table and set the Read column permission to **Organization** ::: :::WorkflowBlockItem Search for **desktopflowbinary** and set the Read column permission to **Organization** ::: :::WorkflowBlockItem Search for **systemuser** and set the Read column permission to **Organization** ::: :::WorkflowBlockItem Click **Save and Close** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/UxmUC9bmv7qvTfNP9fSkh_image-1729095398857.png" size="50" width="3977" height="392" darkWidth="3977" darkHeight="392" position="flex-start" showCaption="false"} ::: :::: ::::: *** :::::ExpandableHeading{isOpen="true"} ## Step 2: Create an Application User ::::WorkflowBlock :::WorkflowBlockItem In the same environment settings, navigate to **Users + Permissions** -> **Application Users** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/zFMGNzYyBT9kun2CDygnq_image-1729095451293.png" size="50" width="1370" height="1139" darkWidth="1370" darkHeight="1139" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click **New App User**, then click **Add an App** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/4Cgz9Ib0UE7-pq_2z9Pmq_image.png" size="50" width="985" height="843" darkWidth="985" darkHeight="843" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Search for and select your pre-registered PAD Export Azure AD app, then click **Add** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/_Kp3AtPM1dLNR9H6v1a3L_image-1728587591696.png" size="50" width="491" height="345" darkWidth="491" darkHeight="345" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click the **Security Roles **pencil icon, select the role created in Step 1, then click **Save** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/hxUKxceCiMpSTqwbL1tH7_image-1728587627163.png" size="50" width="354" height="557" darkWidth="354" darkHeight="557" position="flex-start" showCaption="false"} ::: :::WorkflowBlockItem Click **Create** ::: :::: ::::: *** :::::ExpandableHeading{isOpen="true"} ## Step 3: Generate and Configure the Service Account Secret ::::WorkflowBlock :::WorkflowBlockItem In Azure AD, open your PAD Export app and create a **New Client Secret** ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/UkaMP4maWPOTsWIhQvlPr_image-1728587674048.png" size="50" width="763" height="267" position="flex-start" darkWidth="763" darkHeight="267" showCaption="false"} ::: :::WorkflowBlockItem Copy the **Value** of the generated secret — not the Secret ID ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/XBf0WuBafynEIF4gTGcmt_image-1728587693981.png" size="50" width="840" height="124" position="flex-start" darkWidth="840" darkHeight="124" showCaption="false"} ::: :::WorkflowBlockItem In Blueprint, go to **Settings** > **RPA Management** > **ALC**, enable **Dataverse Synchronization**, and paste the Value into the **Service Account Secret** field ::Image[]{src="https://api.archbee.com/api/optimize/HRPaq4oJ2h9pHAfcjJGa6/MFFdsMtJvEBcDCS60rLHh_dataverse-settings-in-blueprint.png" size="70" width="1652" height="862" position="flex-start" darkWidth="1652" darkHeight="862" showCaption="false"} ::: :::WorkflowBlockItem Click **Save** ::: :::: ::::: Your service account is now configured for Dataverse-based flow imports.