Flowstudio Power Automate Governance

Power Automate Governance with FlowStudio MCP

Classify, tag, and govern Power Automate flows at scale through the FlowStudio MCP cached store — without Dataverse, without the CoE Starter Kit, and without the Power Automate portal.

This skill uses the same store_* tool family as flowstudio-power-automate-monitoring, but with a different intent: governance writes metadata (update_store_flow) and reads for audit and classification outcomes. Monitoring reads the same tools for operational health outcomes. Don't try to memorize which skill "owns" which tool — pick by what the user is doing. For health checks and failure-rate dashboards, load flowstudio-power-automate-monitoring instead.

⚠️ Pro+ subscription required. This skill calls store_* tools that only work for FlowStudio for Teams or MCP Pro+ subscribers.

If the user does not have Pro+ access: the first store_* tool call will return a 403/404 error. When that happens:

1. STOP calling store tools
2. Tell the user governance features require a Pro+ subscription
3. Link them to https://mcp.flowstudio.app/pricing

Discovery: load tool schemas via the meta-tools rather than tools/list — call tool_search with query: "skill:governance" for the canonical bundle, or query: "select:update_store_flow" for a single tool. This skill covers workflow patterns and field semantics — things tool_search cannot tell you. If this document disagrees with a real API response, the API wins.

Critical: How to Extract Flow IDs

list_store_flows returns id in format <environmentId>.<flowId>. You must split on the first . to get environmentName and flowName for all other tools:

id = "Default-<envGuid>.<flowGuid>"
environmentName = "Default-<envGuid>"    (everything before first ".")
flowName = "<flowGuid>"                  (everything after first ".")

Also: skip entries that have no displayName or have state=Deleted — these are sparse records or flows that no longer exist in Power Automate. If a deleted flow has monitor=true, suggest disabling monitoring (update_store_flow with monitor=false) to free up a monitoring slot (standard plan includes 20).

The Write Tool: update_store_flow

update_store_flow writes governance metadata to the FlowStudio cache only — it does NOT modify the flow in Power Automate. These fields are not visible via get_live_flow or the PA portal. They exist only in the FlowStudio store and are used by FlowStudio's scanning pipeline and notification rules.

This means:

• ownerTeam / supportEmail — sets who FlowStudio considers the governance contact. Does NOT change the actual PA flow owner.
• rule_notify_email — sets who receives FlowStudio failure/missing-run notifications. Does NOT change Microsoft's built-in flow failure alerts.
• monitor / critical / businessImpact — FlowStudio classification only. Power Automate has no equivalent fields.

Merge semantics — only fields you provide are updated. Returns the full updated record (same shape as get_store_flow).

Required parameters: environmentName, flowName. All other fields optional.

Settable Fields

Caution with security: The security field on get_store_flow contains structured JSON (e.g. {"triggerRequestAuthenticationType":"All"}). Writing a plain string like "reviewed" will overwrite this. To mark a flow as security-reviewed, use tags instead.

Governance Workflows

1. Compliance Detail Review

Identify flows missing required governance metadata.

1. Ask the user which compliance fields they require
2. list_store_flows
3. For each active flow: split id, call get_store_flow, check required fields
4. Report non-compliant flows with missing fields listed
5. For updates: ask for values, then update_store_flow(...provided fields)

Common compliance fields: description, businessImpact, businessJustification, ownerTeam, supportEmail, monitor, rule_notify_onfail, critical. Ask for the user's policy before flagging.

2. Orphaned Resource Detection

Find flows owned by deleted or disabled Azure AD accounts.

1. list_store_makers
2. Filter where deleted=true AND ownerFlowCount > 0
3. list_store_flows → collect all flows
4. For each active flow: split id, get_store_flow, parse owners JSON
5. Match owner principalId against orphaned maker id
6. Reassign governance contact or stop/tag for decommission

update_store_flow does not transfer actual PA ownership; use the admin center or PowerShell for that. Some orphaned-looking flows are system-generated; tag them instead of reassigning when appropriate. Store coverage is only as fresh as the latest scan.

3. Archive Score Calculation

Compute an inactivity score (0-7) per flow to identify cleanup candidates.

1. list_store_flows
2. For each active flow: split id, get_store_flow
3. Add 1 point each: created≈modified, test/demo/temp/copy name, age >12mo,
   stopped/suspended, no owners, no recent runs, complexity.actions < 5
4. Score 5-7: recommend archive; 3-4: tag #archive-review; 0-2: active
5. For confirmed archive: set_live_flow_state(..., "Stopped") and append #archived

Archive via MCP means stop the flow and tag it. Deletion requires the portal or admin PowerShell.