"Who owns this flow?" — resolving SYSTEM, team and departed owners in Power Automate
Half the flows in a mature tenant show no owner at all in the Flow API. They are not orphans — they belong to SYSTEM, to a team, or to a person who has left — and each of those needs a different action. Here is where the real owner lives and how to read it.
LogiSam··6 min read
The Flow admin API returns, for each cloud flow, a creator object with an object id. It is tempting to call that the owner. It is the account that pressed *New flow*, which is a different thing: a flow created by a consultant, imported in a solution by a service account, or reassigned after a departure carries a creator that has nothing to do with who runs it now.
The three kinds of blank
- SYSTEM. Flows imported inside a managed solution, or created by certain platform processes, are owned by the Dataverse SYSTEM user. The Flow API shows no creator at all. These are not broken — they are the platform's — but they need a human sponsor in an inventory.
- Team. Solution-aware flows can be owned by a Dataverse team. Graph cannot resolve a team id, so a Graph-only lookup returns nothing.
- Former user. The creator id is real but the Entra account is deleted. Graph returns no match. This is the case that matters for governance: the flow runs on connections that will expire when the account's tokens do.
Where the real owner is
Every cloud flow in an environment with a Dataverse database has a row in the workflows table (category eq 5; desktop flows are category eq 6). Its _ownerid_value is the owner the platform enforces, and the annotation on it says whether that is a systemuser or a team. Read the table once per environment with formatted values included, then look up the systemusers rows for the ids you found to get the display name, the email and — usefully — the azureactivedirectoryobjectid, which lets you match the owner back to the Entra account the rest of the inventory uses.
The id mismatch that makes it look like nothing matched
The Flow API names a flow by a GUID. Dataverse has two: workflowid and workflowidunique. The Flow API's name is workflowidunique. Join on the wrong one and every solution flow reads as unmatched, which is easy to mistake for "Dataverse has no owner data" when it has all of it.
What to do with each answer
| Owner resolves to | What it means | Action |
|---|---|---|
| A current user | Normal | None — but record it, because next quarter it may not be |
| A team | Solution-owned, shared responsibility | Record the team; confirm it has members |
| SYSTEM | Platform or managed-solution owned | Assign a sponsor in your inventory; do not try to reassign in Dataverse |
| Former user | Runs on a departed account's connections | Reassign ownership and re-create the connections before they expire |
Keeping it current
Ownership changes without anyone telling the inventory. Resolve it at every sync rather than once, and keep the previous answer alongside — the flow that was owned by a person last month and by nobody this month is exactly the one the governance board should hear about.
Keep reading
Sharing a Power App or flow with yourself as an admin — legitimately
Being a Power Platform Administrator lets you list every flow in the tenant. It does not let you open one. Before a migration or an incident, that gap has to be closed — here is how it is done through the admin surfaces, and how to leave an audit trail while doing it.
Desktop flows are part of your estate too — inventorying Power Automate for desktop from Dataverse
The finance team has eighty desktop flows running month-end. None of them are in your flow count, because the API you are counting with cannot see them. They are in Dataverse, and here is how to bring them into the inventory before they surprise a migration.
How to inventory an entire Microsoft 365 tenant's Power Platform estate in an afternoon
Every environment, every Power App, every Power Automate flow, every connection — the estate is all there, spread across four admin APIs that each refuse to describe the whole. Here is how to bring it into one list, and what to do about the parts Microsoft will not tell you.