[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADJM9GRW4D45FZNWR6F5S9":3,"skill-same:01M6ADJM9GRW4D45FZNWR6F5S9":117},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":58,"linkOnly":59,"markdownContent":60,"markdownBody":61,"frontMatter":62,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6ADJM9GRW4D45FZNWR6F5S9","flowstudio-power-automate-governance",null,"Govern Power Automate flows and Power Apps at scale using the FlowStudio MCP cached store. Classify flows by business impact, detect orphaned resources, audit connector usage, enforce compliance standards, manage notification rules, and compute governance scores — all without Dataverse or the CoE Starter Kit. Load this skill when asked to: tag or classify flows, set business impact, assign ownership, detect orphans, audit connectors, check compliance, compute archive scores, manage notification rules, run a governance review, generate a compliance report, offboard a maker, or any task that involves writing governance metadata to flows. Requires a FlowStudio for Teams or MCP Pro+ subscription — see https:\u002F\u002Fmcp.flowstudio.app","github\u002Fawesome-copilot","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3PBDYPK7NVFJNJ66Y8RS",41046,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fflowstudio-power-automate-governance\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57],"power automate governance","governance","power","flowstudio power automate governance","automate","when","MCP","kit","flows","resources","impact","apps","app","classify","maker","Connector","SET","audit","https","metadata","report","run","generate","teams","connectors","power apps","dataverse","review","writing","2026-11-10 10:12:30",false,"---\nname: flowstudio-power-automate-governance\ndescription: >-\n  Govern Power Automate flows and Power Apps at scale using the FlowStudio MCP\n  cached store. Classify flows by business impact, detect orphaned resources,\n  audit connector usage, enforce compliance standards, manage notification rules,\n  and compute governance scores — all without Dataverse or the CoE Starter Kit.\n  Load this skill when asked to: tag or classify flows, set business impact,\n  assign ownership, detect orphans, audit connectors, check compliance, compute\n  archive scores, manage notification rules, run a governance review, generate\n  a compliance report, offboard a maker, or any task that involves writing\n  governance metadata to flows. Requires a FlowStudio for Teams or MCP Pro+\n  subscription — see https:\u002F\u002Fmcp.flowstudio.app\n---\n\n# Power Automate Governance with FlowStudio MCP\n\nClassify, tag, and govern Power Automate flows at scale through the FlowStudio\nMCP **cached store** — without Dataverse, without the CoE Starter Kit, and\nwithout the Power Automate portal.\n\nThis skill uses the same `store_*` tool family as `flowstudio-power-automate-monitoring`,\nbut with a different *intent*: governance writes metadata (`update_store_flow`)\nand reads for *audit and classification* outcomes. Monitoring reads the same\ntools for *operational health* outcomes. Don't try to memorize which skill\n\"owns\" which tool — pick by what the user is doing. For health checks and\nfailure-rate dashboards, load `flowstudio-power-automate-monitoring` instead.\n\n> **⚠️ Pro+ subscription required.** This skill calls `store_*` tools that\n> only work for FlowStudio for Teams or MCP Pro+ subscribers.\n>\n> **If the user does not have Pro+ access:** the first `store_*` tool call\n> will return a 403\u002F404 error. When that happens:\n> 1. STOP calling store tools\n> 2. Tell the user governance features require a Pro+ subscription\n> 3. Link them to https:\u002F\u002Fmcp.flowstudio.app\u002Fpricing\n>\n> **Discovery:** load tool schemas via the meta-tools rather than `tools\u002Flist` —\n> call `tool_search` with `query: \"skill:governance\"` for the canonical bundle,\n> or `query: \"select:update_store_flow\"` for a single tool. This skill covers\n> workflow patterns and field semantics — things `tool_search` cannot tell you.\n> If this document disagrees with a real API response, the API wins.\n\n---\n\n## Critical: How to Extract Flow IDs\n\n`list_store_flows` returns `id` in format `\u003CenvironmentId>.\u003CflowId>`. **You must split\non the first `.`** to get `environmentName` and `flowName` for all other tools:\n\n```\nid = \"Default-\u003CenvGuid>.\u003CflowGuid>\"\nenvironmentName = \"Default-\u003CenvGuid>\"    (everything before first \".\")\nflowName = \"\u003CflowGuid>\"                  (everything after first \".\")\n```\n\nAlso: skip entries that have no `displayName` or have `state=Deleted` —\nthese are sparse records or flows that no longer exist in Power Automate.\nIf a deleted flow has `monitor=true`, suggest disabling monitoring\n(`update_store_flow` with `monitor=false`) to free up a monitoring slot\n(standard plan includes 20).\n\n---\n\n## The Write Tool: `update_store_flow`\n\n`update_store_flow` writes governance metadata to the **FlowStudio cache\nonly** — it does NOT modify the flow in Power Automate. These fields are\nnot visible via `get_live_flow` or the PA portal. They exist only in the\nFlowStudio store and are used by FlowStudio's scanning pipeline and\nnotification rules.\n\nThis means:\n- `ownerTeam` \u002F `supportEmail` — sets who FlowStudio considers the\n  governance contact. Does NOT change the actual PA flow owner.\n- `rule_notify_email` — sets who receives FlowStudio failure\u002Fmissing-run\n  notifications. Does NOT change Microsoft's built-in flow failure alerts.\n- `monitor` \u002F `critical` \u002F `businessImpact` — FlowStudio classification\n  only. Power Automate has no equivalent fields.\n\nMerge semantics — only fields you provide are updated. Returns the full\nupdated record (same shape as `get_store_flow`).\n\nRequired parameters: `environmentName`, `flowName`. All other fields optional.\n\n### Settable Fields\n\n| Field | Type | Purpose |\n|---|---|---|\n| `monitor` | bool | Enable run-level scanning (standard plan: 20 flows included) |\n| `rule_notify_onfail` | bool | Send email notification on any failed run |\n| `rule_notify_onmissingdays` | number | Send notification when flow hasn't run in N days (0 = disabled) |\n| `rule_notify_email` | string | Comma-separated notification recipients |\n| `description` | string | What the flow does |\n| `tags` | string | Classification tags (also auto-extracted from description `#hashtags`) |\n| `businessImpact` | string | Low \u002F Medium \u002F High \u002F Critical |\n| `businessJustification` | string | Why the flow exists, what process it automates |\n| `businessValue` | string | Business value statement |\n| `ownerTeam` | string | Accountable team |\n| `ownerBusinessUnit` | string | Business unit |\n| `supportGroup` | string | Support escalation group |\n| `supportEmail` | string | Support contact email |\n| `critical` | bool | Designate as business-critical |\n| `tier` | string | Standard or Premium |\n| `security` | string | Security classification or notes |\n\n> **Caution with `security`:** The `security` field on `get_store_flow`\n> contains structured JSON (e.g. `{\"triggerRequestAuthenticationType\":\"All\"}`).\n> Writing a plain string like `\"reviewed\"` will overwrite this. To mark a\n> flow as security-reviewed, use `tags` instead.\n\n---\n\n## Governance Workflows\n\n### 1. Compliance Detail Review\n\nIdentify flows missing required governance metadata.\n\n```\n1. Ask the user which compliance fields they require\n2. list_store_flows\n3. For each active flow: split id, call get_store_flow, check required fields\n4. Report non-compliant flows with missing fields listed\n5. For updates: ask for values, then update_store_flow(...provided fields)\n```\n\nCommon compliance fields: `description`, `businessImpact`,\n`businessJustification`, `ownerTeam`, `supportEmail`, `monitor`,\n`rule_notify_onfail`, `critical`. Ask for the user's policy before flagging.\n\n### 2. Orphaned Resource Detection\n\nFind flows owned by deleted or disabled Azure AD accounts.\n\n```\n1. list_store_makers\n2. Filter where deleted=true AND ownerFlowCount > 0\n3. list_store_flows → collect all flows\n4. For each active flow: split id, get_store_flow, parse owners JSON\n5. Match owner principalId against orphaned maker id\n6. Reassign governance contact or stop\u002Ftag for decommission\n```\n\n`update_store_flow` does not transfer actual PA ownership; use the admin center\nor PowerShell for that. Some orphaned-looking flows are system-generated; tag\nthem instead of reassigning when appropriate. Store coverage is only as fresh as\nthe latest scan.\n\n### 3. Archive Score Calculation\n\nCompute an inactivity score (0-7) per flow to identify cleanup candidates.\n\n```\n1. list_store_flows\n2. For each active flow: split id, get_store_flow\n3. Add 1 point each: created≈modified, test\u002Fdemo\u002Ftemp\u002Fcopy name, age >12mo,\n   stopped\u002Fsuspended, no owners, no recent runs, complexity.actions \u003C 5\n4. Score 5-7: recommend archive; 3-4: tag #archive-review; 0-2: active\n5. For confirmed archive: set_live_flow_state(..., \"Stopped\") and append #archived\n```\n\nArchive via MCP means stop the flow and tag it. Deletion requires the portal or\nadmin PowerShell.\n\n### 4. Connector Audit\n\nAudit which connectors are in use across monitored flows. Useful for DLP\nimpact analysis and premium license planning.\n\n```\n1. list_store_flows(monitor=true)\n2. For each active flow: split id, get_store_flow, parse connections JSON\n3. Group by apiName; flag Premium tier, HTTP connectors, custom connectors\n4. Report inventory to user\n```\n\nScope to monitored flows where possible; each `get_store_flow` call costs time.\n`list_store_connections` lists connection instances, not connector usage per\nflow. DLP policies are not exposed; ask the user for connector classifications.\n\n### 5. Notification Rule Management\n\nConfigure monitoring and alerting for flows at scale.\n\n```\nEnable failure alerts on all critical flows:\n1. list_store_flows(monitor=true)\n2. For each active flow: split id, get_store_flow\n3. If critical=true and rule_notify_onfail is false, update_store_flow(...,\n   rule_notify_onfail=true, rule_notify_email=\"oncall@contoso.com\")\n\nEnable missing-run detection for scheduled flows:\n1. list_store_flows(monitor=true)\n2. For active Recurrence flows: get_store_flow\n3. If rule_notify_onmissingdays is 0\u002Fmissing, update_store_flow(...,\n   rule_notify_onmissingdays=2)\n```\n\nCheck monitoring limits before bulk-enabling `monitor=true`. If no flows have\n`critical=true`, report that as a governance gap before configuring alerts.\n\n### 6. Classification and Tagging\n\nBulk-classify flows by connector type, business function, or risk level.\n\n```\nAuto-tag by connector:\n1. list_store_flows\n2. For each active flow: split id, get_store_flow, parse connections JSON\n3. Map apiName values to tags (#sharepoint, #teams, #email, #custom-connector)\n4. Read existing store tags, append new tags, update_store_flow(tags=...)\n```\n\nStore tags and description hashtags are separate systems. `tags=` overwrites\nstore tags, so read\u002Fappend\u002Fwrite. Avoid overriding computed `tier` unless asked.\n\n### 7. Maker Offboarding\n\nWhen an employee leaves, identify their flows and apps, and reassign\nFlowStudio governance contacts and notification recipients.\n\n```\n1. get_store_maker(makerKey=\"\u003Cdeparting-user-aad-oid>\")\n   → check ownerFlowCount, ownerAppCount, deleted status\n2. list_store_flows → collect all flows\n3. For each active flow: split id, get_store_flow, parse owners JSON\n4. Flag flows whose owner principalId matches the departing user's OID\n5. list_store_power_apps → filter ownerId\n6. For kept flows: update ownerTeam\u002FsupportEmail\u002Frule_notify_email; consider\n   add_live_flow_to_solution before account deletion\n7. For retired flows: set_live_flow_state(..., \"Stopped\") and tag #decommissioned\n8. Report: flows reassigned, flows migrated to solutions, flows stopped,\n   apps needing manual reassignment\n```\n\nThis changes FlowStudio governance contacts, not actual PA ownership. Power\nApps ownership changes are manual\u002Fadmin-center work.\n\n### 8. Security Review\n\nReview flows for potential security concerns using cached store data.\n\n```\n1. list_store_flows(monitor=true)\n2. For each active flow: split id, get_store_flow\n3. Parse security\u002Fconnections\u002FreferencedResources JSON; read sharingType top-level\n4. Report findings; for reviewed flows append #security-reviewed tag\n```\n\nSecurity signals: `security.triggerRequestAuthenticationType`, `sharingType`,\n`connections`, `referencedResources`, `tier`. Never overwrite the structured\n`security` field; tag reviewed flows instead.\n\n### 9. Environment Governance\n\nAudit environments for compliance and sprawl.\n\n```\n1. list_store_environments\n   Skip entries without displayName (tenant-level metadata rows)\n2. Flag:\n   - Developer environments\n   - Non-managed environments\n   - Environments where service account lacks admin access (isAdmin=false)\n3. list_store_flows → group by environmentName\n4. list_store_connections → group by environmentName\n```\n\n### 10. Governance Dashboard\n\nGenerate a tenant-wide governance summary.\n\n```\nEfficient metrics (list calls only):\n1. total_flows = len(list_store_flows())\n2. monitored = len(list_store_flows(monitor=true))\n3. with_onfail = len(list_store_flows(rule_notify_onfail=true))\n4. makers\u002Fapps\u002Fenvs\u002Fconns = list_store_makers\u002Flist_store_power_apps\u002Flist_store_environments\u002Flist_store_connections\n5. Compute monitoring %, notification %, orphan count, high-failure count\n\nDetailed metrics (require get_store_flow per flow — expensive for large tenants):\n- Compliance %: flows with businessImpact set \u002F total active flows\n- Undocumented count: flows without description\n- Tier breakdown: group by tier field\n```\n\n---\n\n## Field Reference: `get_store_flow` Fields Used in Governance\n\nAll fields below are confirmed present on the `get_store_flow` response.\nFields marked with `*` are also available on `list_store_flows` (cheaper).\n\n| Field | Type | Governance use |\n|---|---|---|\n| `displayName` * | string | Archive score (test\u002Fdemo name detection) |\n| `state` * | string | Archive score, lifecycle management |\n| `tier` | string | License audit (Standard vs Premium) |\n| `monitor` * | bool | Is this flow being actively monitored? |\n| `critical` | bool | Business-critical designation (settable via update_store_flow) |\n| `businessImpact` | string | Compliance classification |\n| `businessJustification` | string | Compliance attestation |\n| `ownerTeam` | string | Ownership accountability |\n| `supportEmail` | string | Escalation contact |\n| `rule_notify_onfail` | bool | Failure alerting configured? |\n| `rule_notify_onmissingdays` | number | SLA monitoring configured? |\n| `rule_notify_email` | string | Alert recipients |\n| `description` | string | Documentation completeness |\n| `tags` | string | Classification — `list_store_flows` shows description-extracted hashtags only; store tags written by `update_store_flow` require `get_store_flow` to read back |\n| `runPeriodTotal` * | number | Activity level |\n| `runPeriodFailRate` * | number | Health status |\n| `runLast` | ISO string | Last run timestamp |\n| `scanned` | ISO string | Data freshness |\n| `deleted` | bool | Lifecycle tracking |\n| `createdTime` * | ISO string | Archive score (age) |\n| `lastModifiedTime` * | ISO string | Archive score (staleness) |\n| `owners` | JSON string | Orphan detection, ownership audit — parse with json.loads() |\n| `connections` | JSON string | Connector audit, tier — parse with json.loads() |\n| `complexity` | JSON string | Archive score (simplicity) — parse with json.loads() |\n| `security` | JSON string | Auth type audit — parse with json.loads(), contains `triggerRequestAuthenticationType` |\n| `sharingType` | string | Oversharing detection (top-level, NOT inside security) |\n| `referencedResources` | JSON string | URL audit — parse with json.loads() |\n\n---\n\n## Related Skills\n\n- `flowstudio-power-automate-monitoring` — Health checks, failure rates, inventory (read-only)\n- `flowstudio-power-automate-mcp` — Foundation skill: connection setup, MCP helper, tool discovery\n- `flowstudio-power-automate-debug` — Deep diagnosis with action-level inputs\u002Foutputs\n- `flowstudio-power-automate-build` — Build and deploy flow definitions\n","# Power Automate Governance with FlowStudio MCP\n\nClassify, tag, and govern Power Automate flows at scale through the FlowStudio\nMCP **cached store** — without Dataverse, without the CoE Starter Kit, and\nwithout the Power Automate portal.\n\nThis skill uses the same `store_*` tool family as `flowstudio-power-automate-monitoring`,\nbut with a different *intent*: governance writes metadata (`update_store_flow`)\nand reads for *audit and classification* outcomes. Monitoring reads the same\ntools for *operational health* outcomes. Don't try to memorize which skill\n\"owns\" which tool — pick by what the user is doing. For health checks and\nfailure-rate dashboards, load `flowstudio-power-automate-monitoring` instead.\n\n> **⚠️ Pro+ subscription required.** This skill calls `store_*` tools that\n> only work for FlowStudio for Teams or MCP Pro+ subscribers.\n>\n> **If the user does not have Pro+ access:** the first `store_*` tool call\n> will return a 403\u002F404 error. When that happens:\n> 1. STOP calling store tools\n> 2. Tell the user governance features require a Pro+ subscription\n> 3. Link them to https:\u002F\u002Fmcp.flowstudio.app\u002Fpricing\n>\n> **Discovery:** load tool schemas via the meta-tools rather than `tools\u002Flist` —\n> call `tool_search` with `query: \"skill:governance\"` for the canonical bundle,\n> or `query: \"select:update_store_flow\"` for a single tool. This skill covers\n> workflow patterns and field semantics — things `tool_search` cannot tell you.\n> If this document disagrees with a real API response, the API wins.\n\n---\n\n## Critical: How to Extract Flow IDs\n\n`list_store_flows` returns `id` in format `\u003CenvironmentId>.\u003CflowId>`. **You must split\non the first `.`** to get `environmentName` and `flowName` for all other tools:\n\n```\nid = \"Default-\u003CenvGuid>.\u003CflowGuid>\"\nenvironmentName = \"Default-\u003CenvGuid>\"    (everything before first \".\")\nflowName = \"\u003CflowGuid>\"                  (everything after first \".\")\n```\n\nAlso: skip entries that have no `displayName` or have `state=Deleted` —\nthese are sparse records or flows that no longer exist in Power Automate.\nIf a deleted flow has `monitor=true`, suggest disabling monitoring\n(`update_store_flow` with `monitor=false`) to free up a monitoring slot\n(standard plan includes 20).\n\n---\n\n## The Write Tool: `update_store_flow`\n\n`update_store_flow` writes governance metadata to the **FlowStudio cache\nonly** — it does NOT modify the flow in Power Automate. These fields are\nnot visible via `get_live_flow` or the PA portal. They exist only in the\nFlowStudio store and are used by FlowStudio's scanning pipeline and\nnotification rules.\n\nThis means:\n- `ownerTeam` \u002F `supportEmail` — sets who FlowStudio considers the\n  governance contact. Does NOT change the actual PA flow owner.\n- `rule_notify_email` — sets who receives FlowStudio failure\u002Fmissing-run\n  notifications. Does NOT change Microsoft's built-in flow failure alerts.\n- `monitor` \u002F `critical` \u002F `businessImpact` — FlowStudio classification\n  only. Power Automate has no equivalent fields.\n\nMerge semantics — only fields you provide are updated. Returns the full\nupdated record (same shape as `get_store_flow`).\n\nRequired parameters: `environmentName`, `flowName`. All other fields optional.\n\n### Settable Fields\n\n| Field | Type | Purpose |\n|---|---|---|\n| `monitor` | bool | Enable run-level scanning (standard plan: 20 flows included) |\n| `rule_notify_onfail` | bool | Send email notification on any failed run |\n| `rule_notify_onmissingdays` | number | Send notification when flow hasn't run in N days (0 = disabled) |\n| `rule_notify_email` | string | Comma-separated notification recipients |\n| `description` | string | What the flow does |\n| `tags` | string | Classification tags (also auto-extracted from description `#hashtags`) |\n| `businessImpact` | string | Low \u002F Medium \u002F High \u002F Critical |\n| `businessJustification` | string | Why the flow exists, what process it automates |\n| `businessValue` | string | Business value statement |\n| `ownerTeam` | string | Accountable team |\n| `ownerBusinessUnit` | string | Business unit |\n| `supportGroup` | string | Support escalation group |\n| `supportEmail` | string | Support contact email |\n| `critical` | bool | Designate as business-critical |\n| `tier` | string | Standard or Premium |\n| `security` | string | Security classification or notes |\n\n> **Caution with `security`:** The `security` field on `get_store_flow`\n> contains structured JSON (e.g. `{\"triggerRequestAuthenticationType\":\"All\"}`).\n> Writing a plain string like `\"reviewed\"` will overwrite this. To mark a\n> flow as security-reviewed, use `tags` instead.\n\n---\n\n## Governance Workflows\n\n### 1. Compliance Detail Review\n\nIdentify flows missing required governance metadata.\n\n```\n1. Ask the user which compliance fields they require\n2. list_store_flows\n3. For each active flow: split id, call get_store_flow, check required fields\n4. Report non-compliant flows with missing fields listed\n5. For updates: ask for values, then update_store_flow(...provided fields)\n```\n\nCommon compliance fields: `description`, `businessImpact`,\n`businessJustification`, `ownerTeam`, `supportEmail`, `monitor`,\n`rule_notify_onfail`, `critical`. Ask for the user's policy before flagging.\n\n### 2. Orphaned Resource Detection\n\nFind flows owned by deleted or disabled Azure AD accounts.\n\n```\n1. list_store_makers\n2. Filter where deleted=true AND ownerFlowCount > 0\n3. list_store_flows → collect all flows\n4. For each active flow: split id, get_store_flow, parse owners JSON\n5. Match owner principalId against orphaned maker id\n6. Reassign governance contact or stop\u002Ftag for decommission\n```\n\n`update_store_flow` does not transfer actual PA ownership; use the admin center\nor PowerShell for that. Some orphaned-looking flows are system-generated; tag\nthem instead of reassigning when appropriate. Store coverage is only as fresh as\nthe latest scan.\n\n### 3. Archive Score Calculation\n\nCompute an inactivity score (0-7) per flow to identify cleanup candidates.\n\n```\n1. list_store_flows\n2. For each active flow: split id, get_store_flow\n3. Add 1 point each: created≈modified, test\u002Fdemo\u002Ftemp\u002Fcopy name, age >12mo,\n   stopped\u002Fsuspended, no owners, no recent runs, complexity.actions \u003C 5\n4. Score 5-7: recommend archive; 3-4: tag #archive-review; 0-2: active\n5. For confirmed archive: set_live_flow_state(..., \"Stopped\") and append #archived\n```\n\nArchive via MCP means stop the flow and tag it. Deletion requires the portal or\nadmin PowerShell.\n\n### 4. Connector Audit\n\nAudit which connectors are in use across monitored flows. Useful for DLP\nimpact analysis and premium license planning.\n\n```\n1. list_store_flows(monitor=true)\n2. For each active flow: split id, get_store_flow, parse connections JSON\n3. Group by apiName; flag Premium tier, HTTP connectors, custom connectors\n4. Report inventory to user\n```\n\nScope to monitored flows where possible; each `get_store_flow` call costs time.\n`list_store_connections` lists connection instances, not connector usage per\nflow. DLP policies are not exposed; ask the user for connector classifications.\n\n### 5. Notification Rule Management\n\nConfigure monitoring and alerting for flows at scale.\n\n```\nEnable failure alerts on all critical flows:\n1. list_store_flows(monitor=true)\n2. For each active flow: split id, get_store_flow\n3. If critical=true and rule_notify_onfail is false, update_store_flow(...,\n   rule_notify_onfail=true, rule_notify_email=\"oncall@contoso.com\")\n\nEnable missing-run detection for scheduled flows:\n1. list_store_flows(monitor=true)\n2. For active Recurrence flows: get_store_flow\n3. If rule_notify_onmissingdays is 0\u002Fmissing, update_store_flow(...,\n   rule_notify_onmissingdays=2)\n```\n\nCheck monitoring limits before bulk-enabling `monitor=true`. If no flows have\n`critical=true`, report that as a governance gap before configuring alerts.\n\n### 6. Classification and Tagging\n\nBulk-classify flows by connector type, business function, or risk level.\n\n```\nAuto-tag by connector:\n1. list_store_flows\n2. For each active flow: split id, get_store_flow, parse connections JSON\n3. Map apiName values to tags (#sharepoint, #teams, #email, #custom-connector)\n4. Read existing store tags, append new tags, update_store_flow(tags=...)\n```\n\nStore tags and description hashtags are separate systems. `tags=` overwrites\nstore tags, so read\u002Fappend\u002Fwrite. Avoid overriding computed `tier` unless asked.\n\n### 7. Maker Offboarding\n\nWhen an employee leaves, identify their flows and apps, and reassign\nFlowStudio governance contacts and notification recipients.\n\n```\n1. get_store_maker(makerKey=\"\u003Cdeparting-user-aad-oid>\")\n   → check ownerFlowCount, ownerAppCount, deleted status\n2. list_store_flows → collect all flows\n3. For each active flow: split id, get_store_flow, parse owners JSON\n4. Flag flows whose owner principalId matches the departing user's OID\n5. list_store_power_apps → filter ownerId\n6. For kept flows: update ownerTeam\u002FsupportEmail\u002Frule_notify_email; consider\n   add_live_flow_to_solution before account deletion\n7. For retired flows: set_live_flow_state(..., \"Stopped\") and tag #decommissioned\n8. Report: flows reassigned, flows migrated to solutions, flows stopped,\n   apps needing manual reassignment\n```\n\nThis changes FlowStudio governance contacts, not actual PA ownership. Power\nApps ownership changes are manual\u002Fadmin-center work.\n\n### 8. Security Review\n\nReview flows for potential security concerns using cached store data.\n\n```\n1. list_store_flows(monitor=true)\n2. For each active flow: split id, get_store_flow\n3. Parse security\u002Fconnections\u002FreferencedResources JSON; read sharingType top-level\n4. Report findings; for reviewed flows append #security-reviewed tag\n```\n\nSecurity signals: `security.triggerRequestAuthenticationType`, `sharingType`,\n`connections`, `referencedResources`, `tier`. Never overwrite the structured\n`security` field; tag reviewed flows instead.\n\n### 9. Environment Governance\n\nAudit environments for compliance and sprawl.\n\n```\n1. list_store_environments\n   Skip entries without displayName (tenant-level metadata rows)\n2. Flag:\n   - Developer environments\n   - Non-managed environments\n   - Environments where service account lacks admin access (isAdmin=false)\n3. list_store_flows → group by environmentName\n4. list_store_connections → group by environmentName\n```\n\n### 10. Governance Dashboard\n\nGenerate a tenant-wide governance summary.\n\n```\nEfficient metrics (list calls only):\n1. total_flows = len(list_store_flows())\n2. monitored = len(list_store_flows(monitor=true))\n3. with_onfail = len(list_store_flows(rule_notify_onfail=true))\n4. makers\u002Fapps\u002Fenvs\u002Fconns = list_store_makers\u002Flist_store_power_apps\u002Flist_store_environments\u002Flist_store_connections\n5. Compute monitoring %, notification %, orphan count, high-failure count\n\nDetailed metrics (require get_store_flow per flow — expensive for large tenants):\n- Compliance %: flows with businessImpact set \u002F total active flows\n- Undocumented count: flows without description\n- Tier breakdown: group by tier field\n```\n\n---\n\n## Field Reference: `get_store_flow` Fields Used in Governance\n\nAll fields below are confirmed present on the `get_store_flow` response.\nFields marked with `*` are also available on `list_store_flows` (cheaper).\n\n| Field | Type | Governance use |\n|---|---|---|\n| `displayName` * | string | Archive score (test\u002Fdemo name detection) |\n| `state` * | string | Archive score, lifecycle management |\n| `tier` | string | License audit (Standard vs Premium) |\n| `monitor` * | bool | Is this flow being actively monitored? |\n| `critical` | bool | Business-critical designation (settable via update_store_flow) |\n| `businessImpact` | string | Compliance classification |\n| `businessJustification` | string | Compliance attestation |\n| `ownerTeam` | string | Ownership accountability |\n| `supportEmail` | string | Escalation contact |\n| `rule_notify_onfail` | bool | Failure alerting configured? |\n| `rule_notify_onmissingdays` | number | SLA monitoring configured? |\n| `rule_notify_email` | string | Alert recipients |\n| `description` | string | Documentation completeness |\n| `tags` | string | Classification — `list_store_flows` shows description-extracted hashtags only; store tags written by `update_store_flow` require `get_store_flow` to read back |\n| `runPeriodTotal` * | number | Activity level |\n| `runPeriodFailRate` * | number | Health status |\n| `runLast` | ISO string | Last run timestamp |\n| `scanned` | ISO string | Data freshness |\n| `deleted` | bool | Lifecycle tracking |\n| `createdTime` * | ISO string | Archive score (age) |\n| `lastModifiedTime` * | ISO string | Archive score (staleness) |\n| `owners` | JSON string | Orphan detection, ownership audit — parse with json.loads() |\n| `connections` | JSON string | Connector audit, tier — parse with json.loads() |\n| `complexity` | JSON string | Archive score (simplicity) — parse with json.loads() |\n| `security` | JSON string | Auth type audit — parse with json.loads(), contains `triggerRequestAuthenticationType` |\n| `sharingType` | string | Oversharing detection (top-level, NOT inside security) |\n| `referencedResources` | JSON string | URL audit — parse with json.loads() |\n\n---\n\n## Related Skills\n\n- `flowstudio-power-automate-monitoring` — Health checks, failure rates, inventory (read-only)\n- `flowstudio-power-automate-mcp` — Foundation skill: connection setup, MCP helper, tool discovery\n- `flowstudio-power-automate-debug` — Deep diagnosis with action-level inputs\u002Foutputs\n- `flowstudio-power-automate-build` — Build and deploy flow definitions\n",{"name":5,"description":7},"main","5269f7ea2d6c3a9bfda5ed878b6726cf509121fd","skills\u002Fflowstudio-power-automate-governance",5340,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","https:\u002F\u002Fawesome-copilot.github.com\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 13:41:32",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add github\u002Fawesome-copilot --skill flowstudio-power-automate-governance",{"tool":79,"command":80},"bunx","bunx skills add github\u002Fawesome-copilot --skill flowstudio-power-automate-governance",{"tool":82,"command":83},"pnpm","pnpm dlx skills add github\u002Fawesome-copilot --skill flowstudio-power-automate-governance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fflowstudio-power-automate-governance\u002FSKILL.md",true,[87,93,99,103,109,113],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE.txt","LICENSE","许可证",11357,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002FLICENSE.txt",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Foutput-patterns.md","REFERENCE","参考文档",1813,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002Freferences\u002Foutput-patterns.md",{"path":100,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fworkflows.md",818,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002Freferences\u002Fworkflows.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Finit_skill.py","SCRIPT","脚本",10863,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002Fscripts\u002Finit_skill.py",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fpackage_skill.py",3288,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002Fscripts\u002Fpackage_skill.py",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fquick_validate.py",3523,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002Fscripts\u002Fquick_validate.py",[118,147,173,200,234,250],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":128,"publishedAt":58},"01M70KXZNX9ES38N2A8M58ZZMZ","supabase-rls-policies","Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsupabase-rls-policies\u002FSKILL.md",[124,127],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[129,130,131,132,133,34,56,134,135,136,137,138,139,140,141,142,143,144,145,146],"supabase","rls","supabase rls","supabase rls policies","project","change","read","write","security","isolation","tables","as","tests","prove","use","users","functions","with",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":154,"publishedAt":58},"01M70KWA5YWXDV6V8DZ19E3T2Y","skill-distribution-audit","Audit a skill collection before release or investigate installer omissions, archived\u002Ftemplate leakage, duplicate identities, and manifest drift. Reconcile the intended public source set, distribution manifest, and actual discovery output for a specified consumer version. Includes a deterministic set-comparison helper.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fskill-distribution-audit\u002FSKILL.md",[153],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,156,46,45,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172],"distribution","skill distribution audit","deterministic","installer","for","discovery","comparison","helper","manifest","version","collection","drift","output","investigate","duplicate","template","release","reconcile",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":177,"sourceHtmlUrl":178,"categories":179,"keywords":183,"publishedAt":58},"01M70KCJPFVW7PPQ49CC5R8JGK","logicapps-custom-code-net10-migration","Migrate Azure Logic Apps Standard local-function custom-code projects from .NET 8 to .NET 10. Use for legacy Logic Apps custom-code workspace upgrades, project\u002Fpackage configuration, custom-worker settings, publication, and integrated VS Code debugging. Not for ordinary .NET applications, standalone Azure Functions, Consumption workflows, or cloud deployment.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FSKILL.md",[180],{"categoryNo":181,"categoryName":182,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师",[184,185,186,187,188,189,159,133,190,191,192,193,194,195,196,143,40,197,198,199],"custom","code","logicapps custom code net10 migration","migration","projects","standalone","deployment","applications","local","azure","worker","upgrades","package","Legacy","debugging","workflows",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":204,"sourceHtmlUrl":205,"categories":206,"keywords":211,"publishedAt":58},"01M6AEBN37RQMXJ3298PEY7PG1","winmd-api-search","Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI\u002FML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values).","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FSKILL.md",[207,210],{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":181,"categoryName":182,"taxonomyType":26,"taxonomyTypeDesc":27},[212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,34,227,228,229,230,231,159,232,233],"winmd api search","search","api","windows","desktop","file access","enumeration","ui","ml","file","networking","capabilities","notifications","explore","access","features","full","camera","events","platform","methods","controls",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":238,"licenseFileUrl":239,"sourceHtmlUrl":240,"categories":241,"keywords":247,"publishedAt":58},"01M6AE571R3SC1ZGE202B3NB5S","resemble-detect","Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FSKILL.md",[242,243,246],{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":244,"categoryName":245,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[248,45,221,47,249],"resemble detect","identity",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":238,"licenseFileUrl":254,"sourceHtmlUrl":255,"categories":256,"keywords":261,"publishedAt":58},"01M6AE30BSK2HCY4TQQ22Z8JRD","quality-playbook","Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FSKILL.md",[257,260],{"categoryNo":258,"categoryName":259,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[262,263,264,265,185,56,9,46,266,50,47,49,267,268,269,270,271,272,273,274,275,276,141,277,278,279,280],"playbook","quality playbook","quality","code review","tdd","spec","bug report","council","engineering","functional","spec audit","bug","verified","multi-model","three","coverage","model","regression","structural"]