What APIs permissions must be enabled for Client Credentials Flow authentication

Question

What APIs permissions must be enabled for Client Credentials Flow authentication

Divanshu Johar 40

We have an application 'Infosys Bot Migrator' that migrates RPA bots to Power Automate bots.

We have Dataverse app for authentication and storing the Power Automate Desktop flows into Azure. Currently, we are using Device code authentication flow, and we want to use Clients Credentials authentication flow.

Current APIs that are enabled as:

Dynamics CRM (1)

user_impersonation | Type: Delegated | Description: Access Common Data Service as organiz... | Admin consent required: No

**Microsoft Graph (2)
**Group.Read.All | Type: Delegated | Description: Read all groups | Admin consent required: Yes

User.Read | Type: Delegated | Description: Sign in and read user profile | Admin consent required: No

PowerApps Services (3)

Please help us on what all APIs with type, admin consent, etc. that must use for Client Credentials flow.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Rukmini 11,505 Microsoft External Staff Moderator

Hello Divanshu Johar,

To access Dynamics CRM using client credential flow, no need to grant Dynamics CRM API permission.

You need to create Application User that links to your Microsoft Entra ID application.
Create Dataverse application user using API or in Power Platform Admin Center

Generate access token using scope https://<yourorg>.crm.dynamics.com/.default and using the access token you can call the Dataverse API.

To read all the groups, you can grant Group.Read.All application type API permission and make sure to grant Admin consent:

User's image

Generate access token using scope https://graph.microsoft.com/.default and using the access token you can call the Microsoft Graph API.

To access PowerApps Services, no need to grant PowerApps API permission.

You need to register the client application ID with Microsoft Power Platform to access the PowerApps.
Generate access token using scope https://api.bap.microsoft.com/.default
Refer this thread, by me for calling PowerApps API using client credential flow.

Hope this helps!

If this answers your query, do click Accept Answer and Yes, if you have any further queries do let us know.

If you have any other questions, let me know in the “comments” and I would be happy to help you.

Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-06T11:31:40.1633333+00:00

Hello Divanshu Johar, Following up to see if the above provided answer was helpful. If this answers your query, do click Accept Answer and Yes, if you have any further queries do let us know.
Divanshu Johar 40 Reputation points

2025-11-07T03:52:42.44+00:00

Hi Rukmini,

Can you please help in Generating access token that you have mentioned in the previous response. And please let us know if we can connect with our IT Team to set up the things in one go.
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-07T08:40:33.0066667+00:00

Hello Divanshu Johar,

Generate access token like below:
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-10T09:23:47.97+00:00

Hello Divanshu Johar, Following up to see if the above provided answer was helpful. If this answers your query, do click Accept Answer and Yes, if you have any further queries do let us know.
Divanshu Johar 40 Reputation points

2025-11-10T09:28:43.01+00:00
For Creating Dataverse application user using Power Platform Admin Center, we can follow the below steps. Please correct.

Sign in: With our account

Find environment: Look for environment that we have

Navigate to: Settings → Users + permissions → Application users

Click: "+ New app user"

Add app:

Click "Add an app"

Search for: CLIENT ID

Select your Azure AD application

Click "Add"

Assign role:

Security roles: System Administrator

Click "Create"
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-10T09:30:45.5166667+00:00

Divanshu Johar, Yes you are right!
Divanshu Johar 40 Reputation points

2025-11-11T07:19:39.5733333+00:00

The desktop flows generated with Client Credential authentication will be stored in Desktop flows under make.powerautomate.cloud, unlinke Desktops flows are created in Power Automate Desktop App with Device code authentication flow?
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-11T08:43:37.4866667+00:00
Client Credentials runs as a service principal so all created desktop flows are in the Dataverse environment will be visible in Desktop flows under make.powerautomate.com

Device Code (delegated) runs as a user context, so the desktop flows appear in that user’s Power Automate Desktop app (“My flows”).

This is by design Client Credentials belongs to environment not user.
Divanshu Johar 40 Reputation points

2025-11-13T06:56:03.3733333+00:00
Hi Rukmini,
Thank for your response. Further, please help on below two queries:

We should provide admin right to application user for short term or as one time activity?

For What functionalities or activities, application user with system administrator rights is required for Client Credentials flow?

Our internal IT team needs these answers to provide this access.
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-13T09:15:19.1033333+00:00
Divanshu Johar,

Give the Application User System Administrator permissions only during setup or for a brief period of time during migration, not for ongoing use.

This role is required when the app needs to:

Make or change Dataverse connections, tables, or columns Install or oversee Power Automate Desktop solutions or flows.

Execute environment-level tasks, like reading and writing all data.

Once it is configured, replace it with a custom least-privilege role granting only the required Dataverse and Power Automate permissions.

If the resolution was helpful, kindly take a moment to accept the answer and upvote it 👍 it as a token of appreciation.
Divanshu Johar 40 Reputation points

2025-11-13T09:35:04.57+00:00

Hi Rukmini,

Also, please help us in knowing if there is an alternate to achieve client credential flow without giving admin rights to application user. If there is no such alternate, then please suggest an alternate for client credential authentication flow.

As we need to change Device code authentication flow and client might not accept these types of access for application user for client credential flow.
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-13T09:41:49.3033333+00:00

Divanshu Johar, Please see the above comment I have answered it
Divanshu Johar 40 Reputation points

2025-11-13T09:46:40.1633333+00:00

Hi Rukmini,

I had modified the comment and I mentioned below, please confirm.

"Also, please help us in knowing if there is an alternate to achieve client credential flow without giving admin rights to application user. If there is no such alternate, then please suggest an alternate for client credential authentication flow.

As we need to change Device code authentication flow and client might not accept these types of access for application user for client credential flow."
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-13T09:51:00.79+00:00
Divanshu Johar, Currently, in order to create, change, or access data and Power Automate Desktop flows at the environment level, the Client Credentials flow in Dataverse requires the Application User to have sufficient privileges, usually the System Administrator position.

Since the application operates under a service principle rather than a user and requires environment-level access, there is no other way to use the Client Credentials flow without granting these permissions.

The sole option is to keep using a delegated flow, like the Device Code or Authorization Code flow, where operations are carried out under a particular user's context rather than an app identity, if granting admin permissions isn't acceptable.
Divanshu Johar 40 Reputation points

2025-11-13T10:07:59.8966667+00:00

If Device code and Authorization code flow both are different ways, then please share the APIs that needs to be enabled and what permissions we need to proceed with Authorization code flow.

Please also confirm that Authorization code flow is safest and recommended approach to do. Though, Device code flow is also a way but recently this year, phishing attempt happened as we researched. And also, client was not accepting Device code authentication flow for our use case.

By considering all these factors, please let us know should we proceed with Authorization code or suggest with some other alternate.
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-13T10:11:34.08+00:00

Divanshu Johar, As your initial query is to use Client Credentials Flow authentication, and I have answered for the same.

For the above query of using Authorization code, please post a new question and tag me there and I will assist you.
Rukmini 11,505 Reputation points Microsoft External Staff Moderator

2025-11-13T10:26:29.4666667+00:00

Divanshu Johar, If the resolution was helpful for Client Credentials the initial , kindly take a moment to accept the answer and upvote it 👍 it as a token of appreciation.

Share via

What APIs permissions must be enabled for Client Credentials Flow authentication

0 additional answers

Your answer