Configure proxy settings for Power Automate for desktop

Power Automate for desktop connects to Microsoft cloud services for sign-in, machine registration, flow execution, logging, and updates. In environments where all outbound HTTP traffic must pass through a corporate proxy, each of these connections requires proxy configuration to succeed.

This article explains how proxy configuration works in Power Automate for desktop, identifies the symptoms of misconfigured proxy settings, and provides ready-to-use configuration examples organized by scenario.

When to configure proxy settings

Configure proxy settings if you encounter any of the following errors when starting Power Automate for desktop, registering a machine, or running a desktop flow:

• The proxy server in your network requires authentication.
• The communication with the cloud services requires network proxy authentication.
• During startup Power Automate couldn't sign you in. The proxy server in your network requires authentication.
• System.Net.WebException: The remote server returned an error: (407) Proxy Authentication Required

How proxy configuration works

Configuration sources and priority

Power Automate for desktop resolves proxy settings from the following sources, in priority order:

1. Windows Registry — Keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Power Automate Desktop. If any PAD proxy registry key is present, the registry configuration is used exclusively and the configuration files are ignored entirely.
2. Configuration files — One XML file per component, edited manually. Used when no registry keys are set.
   • Within a file: scriptLocation (PAC) takes priority over proxyaddress (static proxy).
3. Windows system proxy — The proxy configured in Windows Internet Options. Used as a fallback when no PAD-specific configuration exists.

Configuration files vs. registry keys

Both methods configure the same underlying behavior, but they have different capabilities and trade-offs:

Recommendation: Use configuration files for new deployments on version 2.45 and later, especially when PAC scripts are needed or per-component settings are required. Use registry keys for centralized management via Group Policy or MDM, or for deployments on versions prior to 2.45.

Per-component configuration files

Power Automate for desktop runs as multiple separate processes under different Windows accounts. Each process has its own proxy configuration file, stored in C:\Program Files (x86)\Power Automate Desktop:

Scenario 1: Use a static proxy server

When to use this: Your organization routes all internet traffic through a single proxy server with a fixed hostname and port.

Configuration file

Edit all four configuration files:

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy useDefaultCredentials="false">
  <proxy
    proxyaddress="http://proxy.corp.com:8080"
    bypassonlocal="True"
  />
</defaultProxy>

Registry alternative

Set the following registry value. This setting affects all PAD components simultaneously.

To set this value from an elevated command prompt:

reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v ProxyServer /t REG_SZ /d "http://proxy.corp.com:8080" /f

To also bypass the proxy for local addresses (equivalent to bypassonlocal="True"):

reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v ProxyServer /t REG_SZ /d "http://proxy.corp.com:8080" /f
reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v BypassProxyOnLocal /t REG_DWORD /d 1 /f

Scenario 2: Authenticated proxy (use Windows credentials)

When to use this scenario: Your proxy uses Windows-integrated authentication (NTLM or Kerberos) and the signed-in user's credentials are forwarded automatically.

Configuration file

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy useDefaultCredentials="true">
  <proxy
    proxyaddress="http://proxy.corp.com:8080"
    bypassonlocal="True"
  />
</defaultProxy>

Setting useDefaultCredentials="true" instructs PAD to send the current Windows user's credentials to the proxy with each request, which resolves 407 errors in Windows-integrated authentication environments.

Registry alternative

Set both values. UseDefaultProxyCredentials requires ProxyServer to also be set.

reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v ProxyServer /t REG_SZ /d "http://proxy.corp.com:8080" /f
reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v UseDefaultProxyCredentials /t REG_DWORD /d 1 /f

Scenario 3: Skip the proxy for internal addresses (bypass list)

When to use this: Most traffic goes through the proxy, but requests to specific internal hostnames, IP ranges, or domains connect directly.

Configuration file

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy useDefaultCredentials="false">
  <proxy
    proxyaddress="http://proxy.corp.com:8080"
    bypassonlocal="True"
  />
  <bypasslist>
    <add address="intranet\.corp\.com" />
    <add address=".*\.internal\.corp\.com" />
    <add address="10\.0\." />
    <add address="192\.168\." />
  </bypasslist>
</defaultProxy>

Bypass list rules (configuration file):

• Each address value is a .NET regular expression matched against the destination hostname or IP address string.
• Escape dots (.) in hostnames as \. to avoid matching any character.
• Don't start patterns with *. Use .* or .+ for variable-length prefixes.
• bypassonlocal="True" on the <proxy> element already handles plain single-label hostnames and loopback. The <bypasslist> handles more specific patterns.

Registry alternative

The registry bypass list uses a comma-separated string of .NET regular expression patterns.

reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v ProxyServer /t REG_SZ /d "http://proxy.corp.com:8080" /f
reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v BypassProxyOnLocal /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v ProxyBypassList /t REG_SZ /d "\.internal\.corp\.com, 10\.0\., 192\.168\." /f

Scenario 4: Use a PAC script from a URL

When to use this: Your network team publishes a PAC (Proxy Auto-Config) script at an HTTP or HTTPS URL. The script selects a proxy or direct connection based on the destination URL.

Configuration file

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy useDefaultCredentials="false">
  <proxy
    scriptLocation="http://proxy.corp.com/proxy.pac"
  />
</defaultProxy>

For a PAC script served over HTTPS:

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy useDefaultCredentials="false">
  <proxy
    scriptLocation="https://proxy.corp.com/proxy.pac"
  />
</defaultProxy>

How PAC resolution works in Power Automate for desktop:

• The PAC script downloads once at startup and caches in memory for one hour.
• Cache revalidation uses HTTP ETag / If-None-Match headers. A 304 Not Modified response extends the cache for another hour without re-downloading.
• If a download fails but a valid cached copy exists, PAD continues using the cached copy. If no cached copy is available and the download fails, proxy resolution fails for this component.
• FindProxyForURL(url, host) is called for each outbound HTTP request.
• If the script throws a JavaScript error, PAD falls back to DIRECT for that request.
• scriptLocation takes priority over proxyaddress. If both are present in the same file, proxyaddress is ignored.

Scenario 5: Use a PAC script from a local file

When to use this: Use this scenario when the PAC script is a file on the local machine, such as in air-gapped environments, or when testing a PAC configuration before publishing it to a URL.

Configuration file

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy useDefaultCredentials="false">
  <proxy
    scriptLocation="file:///C:/ProxyConfig/proxy.pac"
  />
</defaultProxy>

Notes:

• Use file:/// (three forward slashes) followed by an absolute path with forward slashes.
• The account running each component must be able to read the PAC file. For UIFlowService.Proxy.config, NT SERVICE\UIFlowService needs read access. For the log shipper, NetworkService needs read access.
• Local file PAC scripts use the same one-hour in-memory cache. If you update the file, the change takes effect after the cache expires or after restarting the application and services.
• If the file doesn't exist at startup, PAD logs a FileNotFoundException error and proxy resolution fails for this component.

Enabling PAC script support

PAC script support (scriptLocation) is available starting in version 2.67 and is disabled by default. To enable it, set the following registry flag on each machine:

reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v EnablePacProxy /t REG_DWORD /d 1 /f

Scenario 6: Disable proxy entirely

When to use this: Power Automate for desktop picks up a Windows system proxy that you don't want it to use. For example, a browser proxy configured in Internet Options that doesn't apply to PAD's cloud traffic.

Configuration file

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy enabled="false">
</defaultProxy>

Setting enabled="false" causes PAD to ignore the Windows system proxy and connect directly. No <proxy> or <bypasslist> elements are needed.

Registry alternative

reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v DisableWindowsProxy /t REG_DWORD /d 1 /f

Scenario 7: Configure proxy credentials for background services

When to use this: The interactive Console and Designer work correctly with Windows-integrated authentication, but unattended flow execution fails because UIFlowService.exe runs as NT SERVICE\UIFlowService - a virtual account without domain credentials accepted by the proxy.

Option A: Configuration file (per-component)

Edit UIFlowService.Proxy.config independently from PAD.Proxy.config. Use this option for a proxy that allows unauthenticated access from service accounts:

<?xml version="1.0" encoding="utf-8"?>
<defaultProxy useDefaultCredentials="false">
  <proxy
    proxyaddress="http://proxy.corp.com:8080"
    bypassonlocal="True"
  />
</defaultProxy>

Option B: Explicit credentials via Windows Credential Manager (registry)

If the proxy requires a specific username and password that isn't tied to a Windows domain account, store the credential in Windows Credential Manager and reference it through the registry. This approach works for all PAD components.

Step 1: Store the credential

1. Open Credential Manager → Windows Credentials → Add a generic credential.
2. Set Internet or network address to a name of your choice, such as PAD_Proxy.
3. Enter the proxy Username and Password, and then select OK.

Step 2: Set registry keys

ProxyNetworkCredentialsKey requires ProxyServer to also be set.

reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v ProxyServer /t REG_SZ /d "http://proxy.corp.com:8080" /f
reg add "HKLM\SOFTWARE\Microsoft\Power Automate Desktop" /v ProxyNetworkCredentialsKey /t REG_SZ /d "PAD_Proxy" /f

PAD retrieves the stored username and password from Credential Manager at runtime and uses them as explicit NetworkCredential for proxy authentication.

Apply configuration changes

Apply configuration file changes

1. Close Power Automate for desktop. Confirm no PAD icon remains in the system tray and no PAD processes are running in Task Manager.

2. Open each configuration file in a text editor with administrator privileges. All four files are in C:\Program Files (x86)\Power Automate Desktop.

3. Apply the same proxy settings to all four files:

   • PAD.Proxy.config
   • UIFlowService.Proxy.config
   • Microsoft.Flow.RPA.LogShipper.Proxy.config
   • Microsoft.Flow.RPA.UpdateService.Proxy.config

4. Restart the Windows services. Open an elevated command prompt and run:

   net stop UIFlowService && net start UIFlowService
   net stop "Power Automate Log Shipper" && net start "Power Automate Log Shipper"
   net stop "Power Automate Update Service" && net start "Power Automate Update Service"
   

   Confirm exact service names in Services (services.msc) before running.

5. Start Power Automate for desktop and verify that sign-in and machine registration succeed.

Applying registry changes

Registry changes take effect when the relevant PAD process starts. Restart all PAD components after making registry changes:

1. Close Power Automate for desktop.
2. Restart all three PAD Windows services (use the same commands as earlier in the article).
3. Start Power Automate for desktop.

Configuration reference

Configuration file schema

All four proxy configuration files use the same XML schema.

<defaultProxy> attributes

<proxy> child element attributes

<bypasslist> element

The <bypasslist> element contains one or more <add> child elements:

<bypasslist>
  <add address="regex-pattern" />
</bypasslist>

Registry keys reference

All registry keys are under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Power Automate Desktop.

PAC script reference

Supported PAC functions

You can use the following functions inside FindProxyForURL(url, host).

Host classification

DNS and IP address

Pattern matching

Time-based routing

IPv6 extension functions (registered only when the OS supports IPv6):

Result string behavior

Caching behavior

Troubleshooting