What APIs permissions must be enabled for Client Credentials Flow authentication

Hello Divanshu Johar, Following up to see if the above provided answer was helpful. If this answers your query, do click Accept Answer and Yes, if you have any further queries do let us know.

Hi Rukmini,

Can you please help in Generating access token that you have mentioned in the previous response. And please let us know if we can connect with our IT Team to set up the things in one go.

Hello Divanshu Johar,

Generate access token like below:

Hello Divanshu Johar, Following up to see if the above provided answer was helpful. If this answers your query, do click Accept Answer and Yes, if you have any further queries do let us know.

For Creating Dataverse application user using Power Platform Admin Center, we can follow the below steps. Please correct.

1. Sign in: With our account
2. Find environment: Look for environment that we have
3. Navigate to: Settings → Users + permissions → Application users
4. Click: "+ New app user"
5. Add app:

• Click "Add an app"
  • Search for: CLIENT ID
  • Select your Azure AD application
  • Click "Add"

1. Assign role:
   • Security roles: System Administrator
   • Click "Create"

Divanshu Johar, Yes you are right!

The desktop flows generated with Client Credential authentication will be stored in Desktop flows under make.powerautomate.cloud, unlinke Desktops flows are created in Power Automate Desktop App with Device code authentication flow?

• Client Credentials runs as a service principal so all created desktop flows are in the Dataverse environment will be visible in Desktop flows under make.powerautomate.com
• Device Code (delegated) runs as a user context, so the desktop flows appear in that user’s Power Automate Desktop app (“My flows”).

This is by design Client Credentials belongs to environment not user.

Hi Rukmini,
Thank for your response. Further, please help on below two queries:

• We should provide admin right to application user for short term or as one time activity?
• For What functionalities or activities, application user with system administrator rights is required for Client Credentials flow?

Our internal IT team needs these answers to provide this access.

Divanshu Johar,

Give the Application User System Administrator permissions only during setup or for a brief period of time during migration, not for ongoing use.

This role is required when the app needs to:

• Make or change Dataverse connections, tables, or columns Install or oversee Power Automate Desktop solutions or flows.
• Execute environment-level tasks, like reading and writing all data.
• Once it is configured, replace it with a custom least-privilege role granting only the required Dataverse and Power Automate permissions.

If the resolution was helpful, kindly take a moment to accept the answer and upvote it 👍 it as a token of appreciation.

Hi Rukmini,

Also, please help us in knowing if there is an alternate to achieve client credential flow without giving admin rights to application user. If there is no such alternate, then please suggest an alternate for client credential authentication flow.

As we need to change Device code authentication flow and client might not accept these types of access for application user for client credential flow.

Divanshu Johar, Please see the above comment I have answered it

Hi Rukmini,

I had modified the comment and I mentioned below, please confirm.

"Also, please help us in knowing if there is an alternate to achieve client credential flow without giving admin rights to application user. If there is no such alternate, then please suggest an alternate for client credential authentication flow.

As we need to change Device code authentication flow and client might not accept these types of access for application user for client credential flow."

Divanshu Johar, Currently, in order to create, change, or access data and Power Automate Desktop flows at the environment level, the Client Credentials flow in Dataverse requires the Application User to have sufficient privileges, usually the System Administrator position.

• Since the application operates under a service principle rather than a user and requires environment-level access, there is no other way to use the Client Credentials flow without granting these permissions.
• The sole option is to keep using a delegated flow, like the Device Code or Authorization Code flow, where operations are carried out under a particular user's context rather than an app identity, if granting admin permissions isn't acceptable.

If Device code and Authorization code flow both are different ways, then please share the APIs that needs to be enabled and what permissions we need to proceed with Authorization code flow.

Please also confirm that Authorization code flow is safest and recommended approach to do. Though, Device code flow is also a way but recently this year, phishing attempt happened as we researched. And also, client was not accepting Device code authentication flow for our use case.

By considering all these factors, please let us know should we proceed with Authorization code or suggest with some other alternate.

Divanshu Johar, As your initial query is to use Client Credentials Flow authentication, and I have answered for the same.

For the above query of using Authorization code, please post a new question and tag me there and I will assist you.