Where is this power automate created?

(2) Share

Report

Posted on by Rohit4044041

286

We have an issue in sharepoint tenant where "Something" is updating sharepoint data.

After getting audit logs from purview, we found an entry which indicated this was done by some power automate.
Now, no one knows who developed that power automate. We see something like below in audit logs
I tried to find power automate from admin center however below IDs are neither Run ID nor FlowID. They are something called workflow ID (as used in logic apps )
So, is there any way to identify this power automate based on give below details?
I have tried powershell and tennat logs with no luck

azure-logic-apps/1.0 (workflow f1416afab8d547eda2f9a305ad51333e; version 08584373586050414667) microsoft-flow/1.0

Categories:

Process Advisor

I have the same question (0)

All responses (7)

Answers (0)

chiaraalina 1,057 on at

Like (0)

Report

Where is this power automate created?

Hi

Did you check the Power Automate run history (Monitor)?

Go to Power Platform Admin Center and click on Monitor in the navigation.

There you can see all the flow that were running. I think the Id is not the same but maybe you can compare the date and time when it run and find out which flow it was.

Was this reply helpful? Yes No
Suggested answer

developerAJ 4,611 on at

Like (0)

Report

Where is this power automate created?

this id f1416afab8d547eda2f9a305ad51333e is nothing but workflowid without - in between

you can use powershell or power automate to get all flows in the environment and remove - from them and compare to get respective workflow you are looking for it

If this solution helped you resolve your issue, kindly mark it as accepted — it makes it easier for others to find and also closes the discussion. If you found it useful, a Like ❤️ would be greatly appreciated!

🏷️ Please tag me @developerAJ if you still have any queries or issue persists

🤝 Let’s connect on LinkedIn

📘 Explore more on my articles

🐱‍💻 Github Link

💼👥 Looking for Jobs Power Platform & Microsoft Jobs Network

Was this reply helpful? Yes No
developerAJ 4,611 on at

Like (0)

Report

Where is this power automate created?

easiest way is to create a support ticket with microsoft to get the relvant flow but time-consuming way

Was this reply helpful? Yes No
Rohit4044041 286 on at

Like (0)

Report

Where is this power automate created?

Thank you Both

@chiaraalina Unfortunately tenant level analytics were not enabled. Its enabled now. We will give it a try once logs start appearing . Wonder why they did not turn it on by default :(

@developerAJ : ID shared is not a flow ID so cant really construct URLs. For whatever reason audits include workflow ID instead of FlowID. (WorkflowID is more of LogicApps terminology). I agree, if there is now way, we will knock at MS

Was this reply helpful? Yes No
developerAJ 4,611 on at

Like (0)

Report

Where is this power automate created?

FYI:

1 people found this reply helpful.

Was this reply helpful? Yes No
developerAJ 4,611 on at

Like (0)

Report

Where is this power automate created?

Reach out to Microsoft that's the easiest way with no effort from your side but we all know it takes time

if time is not a constraint Microsoft support is the best way here

Was this reply helpful? Yes No
Rohit4044041 286 on at

Like (1)

Report

Where is this power automate created?

Thank you @developerAJ. That gave me some direction but no luck yet. As you see below, what we get from M365 audit log is Workflow ID which f1416afab8d547eda2f9a305ad51341e . However flow ID is different (shown in URL)

Currently we do not know which flow it is. We only have workflow ID i.e. f1416afab8d547eda2f9a305ad51341e

Trying to find a flow ID/name based on this workflow ID.

No idea, why MS decided to have this disconnected logs entry.

As you suggested, we are also raising ticket with MS

Was this reply helpful? Yes No