search

microsoft / coe-starter-kit

Other
752 stars 225 forks source link

[CoE Starter Kit - Feature]: Monitoring of 'Who can trigger this flow' in the HTTP action 'When a HTTP request is received' in CoE Power BI dashboards #7576

Open pjarqueo opened 9 months ago

pjarqueo commented 9 months ago

Is your feature request related to a problem? Please describe.

Since the last October 2023, the action of the connector 'When a HTTP request is received' enables the option of 'Who can trigger this flow' to a total of three options: 1) Any user in my tenant. 2) Specific users in my tenant. 3) Anyone (Which was the predefined option). The problem is that despite it is possible to monitor the connector HTTP when it is being triggered in the CoE dashboards tables, it is not possible to monitor which from those connector actions 'When a HTTP request is received' that have been used in the flows of the tenant have selected any from these three options so that it could be monitored which of them remain as 'Anyone' in order to fix them to any of the two other new options available.

Describe the solution you'd like

The solution would consist on the addition of the feature of being able to monitor the 'Who can trigger this flow' security action selected in the current flows using this action connector 'When a HTTP request is received' in the Power BI CoE dashboards in order to being able to cleanup and change their options.

Describe alternatives you've considered

A tenant isolation test has been performed in order whether it was possible or not ensure that the tenant could be completely isolated from POST messages but seems that it is triggered anyway. So the alternative now is to isolate the solutions containing this HTTP action connector in a dedicated environment with a security group in order to contain the impact but it remains the possibility for anyone to create flows with this HTTP action connector with any of these three security options described above and the key question here: Not able to monitor in a gathered dashboard which of them remain with "Anyone" option selected.

Additional context?

When_a_HTTP_request_is_received

AB#2182

Jenefer-Monroe commented 9 months ago

Thank you for the suggestion! Will put this on the backlog to explore.

pjarqueo commented 4 months ago

Hi Jenefer. Could you please tell us what is the state of this suggestion? Is it going to be applied in next releases? Thank you very much in advance

Jenefer-Monroe commented 4 months ago

No unfortunately this is not funded at this time. We have some big competing priorities for the next several months and so other new feature developments are on hold. You can track progress of individual work items by looking at the status and milestone fields shown here: image

pjarqueo commented 4 months ago

No unfortunately this is not funded at this time. We have some big competing priorities for the next several months and so other new feature developments are on hold. You can track progress of individual work items by looking at the status and milestone fields shown here: image

Thank you for the update Jenefer and I note how to check properly the status thanks to your screenshot. Apart from that please consider this addition as the security matters of this connector is being fixed by Microsoft as per our latest communication from the Product owner's team. Best Regards.