How to find required API permissions for a command?

[daviewales]

I have been able to log in using a dedicated Entra app registration.
However, I'm struggling to determine the required permissions / scopes for a given sub-command.

For example, I'm wanting to run the Power Automate commands in the flow namespace.

I'm getting the following error:

m365 flow environment get
{"error":"invalid_grant: AADSTS65001: The user or administrator has not consented to use the application with ID 'abc-123' named 'Example'. Send an interactive authorization request for this user and resource. Trace ID: abc-123 Correlation ID: abc-123 Timestamp: 2024-10-02 03:18:04Z"}

However, we've added the permissions as best we can work out:

I'm aware of the related issues and PR:

• Introduce Permissions section in docs #4399
• Include needed Graph API permissions per each command #6380
• Introduces support for documenting minimal command permissions. #6342

But I'm wondering if there is a way I can figure out the required permissions myself in the meantime?
I've tried searching for API documentation, but I'm struggling to find anything meaningful for the Power Automate API.

I've even peeked at the code, but am none the wiser:
https://github.com/pnp/cli-microsoft365/blob/main/src/m365/flow/commands/environment/environment-get.spec.ts

How can I determine the required API permissions for the m365 flow sub-commands?

[milanholemans]

Hi, we know that finding out permissions is a real pain right now. That's why we are investing a lot of time to show the permissions needed to run each command.
For now, there are two possible ways to unblock you.

1. You can run m365 setup. This command is able to set up a new app registration with all the permissions needed to run all commands from CLI. It will basically set up your own PnP Management Shell app registration.
2. If you want to add permissions manually, currently the only way to find out which permissions are needed is just by checking which requests are being made. But this is sometimes not that obvious to do (like for Power Automate commands). In this case, you can always reach out to us like you did now, and we'll try to figure out which permissions you need.
   For Power Automate commands, if I'm not mistaken, you'll need the Azure Service Management permission:

[daviewales]

This enabled the following commands:

• m365 flow environment list
• m365 flow environment get
• m365 flow list
• m365 flow get
• m365 flow enable
• m365 flow disable
• m365 flow owner list (Interestingly, this takes --flowName rather than -n --name, which is inconsistent with the other commands.)
• m365 flow run list (This one had --flowName instead of -n --name too.)
• m365 flow run get (This one had --flowName, but it makes sense because -n --name is taken by the run name.)

The following still don't work due to insufficient permissions:

• m365 flow connector list
• m365 flow export

I haven't tried any others.

Could you suggest an API permission to enable flow export?

[milanholemans]

Seems like m365 flow export uses 2 different endpoints. The one you've already granted, and also a Power Apps endpoint.
Could you try to add this permission? When going to the Add a permission window, be sure to switch to the APIs my organization uses tab.

I think you'll need the same permission for m365 flow connector list.

[milanholemans]

m365 flow owner list (Interestingly, this takes --flowName rather than -n --name, which is inconsistent with the other commands.)
m365 flow run list (This one had --flowName instead of -n --name too.)
m365 flow run get (This one had --flowName, but it makes sense because -n --name is taken by the run name.)

Regarding the naming of options, we follow a pattern where the option refers to the context of the last noun in the command. For example, in the command m365 flow get, the name option refers to the flow itself, so it represents the name of a flow.

However, in a command like m365 flow owner list, if we were to use the option name, it would imply the name of an owner, which is not what we want. To avoid confusion, we use flowName instead, making it clear that it refers to the name of the flow, not the owner.

[daviewales]

Thanks, that makes sense. I'll try the PowerApps Service permission.

[daviewales]

Thanks, this was the missing piece. I can use flow export now. 😄