## Microsoft Power Automate integration

Microsoft Power Automate is Microsoft's workflow automation service. Cloud flows are stored as Dataverse rows, so this integration talks to the **Dataverse Web API** of your environment. Integrating Power Automate with Frontegg lets your application read and manage cloud flows on behalf of your users through Frontegg's integration layer. Authentication is OAuth 2.0 (Authorization Code flow) via Microsoft Entra, and the access token is issued for your Dataverse environment as its own resource — so, in addition to a Client ID and Client Secret, you provide your **Dataverse environment host**.

Prerequisites
- A [Microsoft Power Automate](https://make.powerautomate.com/) account with a Dataverse environment, and access to the [Microsoft Entra admin center](https://entra.microsoft.com/)
- Permission to register applications in your Microsoft Entra directory (and, for organization-wide use, to grant admin consent)


### Connect to Microsoft Power Automate

You register an application in Microsoft Entra. The app provides the **Application (client) ID** and a **Client Secret**, and defines the **redirect URI** that Microsoft returns users to after they authorize access. You also provide your **Dataverse environment host** and, for single-tenant apps, your **Directory (tenant) ID**.

#### Step 1: Register an application

Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) and go to **Entra ID → App registrations**. Click **New registration**, enter a name (for example `Frontegg Integration`), choose the supported account types that match your use case, and click **Register**.

#### Step 2: Copy the Application (client) ID and Directory (tenant) ID

On the app's **Overview** page, copy the **Application (client) ID** — this is your **Client ID**. If your app is single-tenant, also copy the **Directory (tenant) ID**. For multi-tenant apps, you can leave the tenant ID as `common` in Frontegg.

![Microsoft Entra app Overview page showing the Application (client) ID and Directory (tenant) ID](/assets/microsoft-power-automate-1.bb8d1513b003b613a0dc01baff2df8ba59de14fc80099aa5b74c06cbb250ed23.1ce25488.png)

#### Step 3: Add the redirect URI

Open **Authentication**, add a **Web** platform (if not already present), and set the redirect URI to your Frontegg Redirect URL: `https://YOUR_MCP_GATEWAY_URL/integration-callback`

![Microsoft Entra Authentication page with a Web redirect URI](/assets/microsoft-power-automate-2.1dfc07450cb0a1ebabd2c9f063d21ba2e4ed4429fd78327e8cfb682119c821ce.1ce25488.png)

#### Step 4: Create a client secret

Open **Certificates & secrets → Client secrets** and click **New client secret**. Add a description and an expiry, then click **Add**. Copy the secret **Value** immediately.

Copy your Client Secret now
The secret **Value** is shown only once, right after you create it — Entra masks it afterward and shows only the Secret ID. Copy it immediately and store it securely; treat it like a password. If you lose it, create a new client secret.

![Microsoft Entra Certificates & secrets page with a client secret](/assets/microsoft-power-automate-3.defb02c01767f1572c05416ec5800356a11b0038fb5ca2a5e4e1504d63a93220.1ce25488.png)

#### Step 5: Add the Dataverse (Dynamics CRM) permission

Open **API permissions → Add a permission → Dynamics CRM**, select the **user_impersonation** delegated permission ("Access Common Data Service as organization users"), and add it. For organization-wide use, an administrator may need to click **Grant admin consent**.

![Microsoft Entra API permissions page showing the Dynamics CRM user_impersonation permission](/assets/microsoft-power-automate-4.f874618b904f61c88b44f3322c979086ccc9e7eb907b5805138e302c89475f39.1ce25488.png)

#### Step 6: Find your Dataverse environment host

Your **Dataverse environment host** is the host of the environment that holds your flows, without the scheme — for example `contoso.crm4.dynamics.com`. Find it in Power Automate under **Settings → Session details**, or in the **Power Platform admin center** under your environment's details.

### Configure the Frontegg portal

Once you have your **Client ID**, **Client Secret**, and **Dataverse environment host**, configure the integration in the Frontegg portal:

1. Open the **Frontegg portal** and navigate to [ENVIRONMENT] → Integrations → Microsoft Power Automate.
2. Enter the **Client ID** (Application (client) ID) and the **Client Secret**.
3. Enter your **Dataverse environment host** (for example, `contoso.crm4.dynamics.com`).
4. Enter your **Directory (tenant) ID** for a single-tenant app, or leave it as `common` for a multi-tenant app.
5. Click **Save**.


Keep your credentials secure
Never share or commit your Client Secret to version control.

### Scopes

Frontegg requests the Dataverse `user_impersonation` scope (scoped to your environment host), plus `openid` and `offline_access` for the auth handshake and refresh tokens:

| Scope | Description |
|  --- | --- |
| `user_impersonation` | Access the Dataverse Web API (Common Data Service) as the signed-in user |
| `openid` | OpenID Connect sign-in |
| `offline_access` | Obtain a refresh token for long-lived access |


### Additional resources

- [Register an application with the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)
- [Manage Power Automate flows with code (Dataverse)](https://learn.microsoft.com/en-us/power-automate/manage-flows-with-code)
- [How to get your Redirect URL](/agen-for-work/connectors/redirect-url)