How to authenticate as an application with Microsoft Graph API with flow

What is Microsoft Graph API?

Microsoft Graph API is an access point for all your data across your applications and services in your Microsoft cloud. 

Previously there were different SDKs with their own security, messaging and data format requirements - there was inconsistency and the learning curve for developers was a challenge. Examples are OneDrive for Business, Outlook, Azure Active Directory, Discovery Service and so forth. In Microsoft Graph the APIs are centralised providing a standardised structure for applications to be built on top of the different services also provides capabilities in extending the experience of the  application or service such as Microsoft Teams. This allows developers to build with reduced effort compared to the previous way of having to learn the different SDKs.

Authentication with Microsoft Graph API

There are two types

1. Delegated permissions which requires user consent
2. Application permissions which requires admin consent

Today with the connectors in flow within Power Automate, the connector authenticates through a user account. An example is the Office 365 Users connector, as the flow maker it will use your user account as the credentials and you are required to give consent for the Microsoft Graph API to authenticate as you. Below is a screenshot that shows how the authentication method is of a user account.

For Microsoft Dataverse, there's the method of authenticating as a Service Principal Account which is essentially an application user. The Service Principal Account can be used as the authentication method for the CDS current environment connector. But what about the other connectors such as the Office 365 User connector I mentioned?

This is where you would need to do some investigation to find what option is suitable for your organisation and what you're trying to achieve with flow in Power Automate. One option is to authenticate as an application which is what I'll be sharing in this WTF episode.

This WTF episode is a side explanation to a webinar I hosted in the week of Thanksgiving 2020 where I demonstrated how the Power Platform can be used to support a hybrid workforce of teams working from the office or remotely. I go give an overview on the following,

1. How a Canvas app with a PCF control can be used to allow employee to communicate where they are working from for the week and if working from the office, they can select a floor and desk of where to sit
2. How to change the look and feel of cards in Microsoft Lists using JSON
3. How a manager can interact with a bot through Power Virtual Agents in Microsoft Dataverse for Teams where a flow does the magic to display the list of employees back to the manager - this is where the authenticate as an application with Microsoft Graph API is use

You can watch the webinar recording here.

Part 1 - Create an app registration

To authenticate as an application with the Microsoft Graph API, an app registration needs to be created which can be done in the Microsoft Azure portal. I did cover this in a previous WTF episode but I'll run through it again.

Log into Azure portal, click on App Registrations and click on +New Registration. If you don't see the following below when you log into the Azure portal, search for App Registration.

Enter a Name and select whether you want a single tenant or multiple tenant followed by the register button. Refer to the table in this docs.microsoft.com article that explains the differences of the account options.

Once created you'll see details of the App Registration which will be referenced in the connector in flow within Power Automate.

Two more items need to be configured afterwards. The first one I showed in my vlog was to create a Client Secret which will be for the security of a connector in flow within Power Automate. Head to Certificates & secrets, click +New client secret.

Enter a name for the Client Secret. Select the a suitable option for the expiry setting and then click add.

The Client Secret will be created. Copy the Client Secret value and save it some where as this will be used when configuring the authentication of a connector in flow within Power Automate.

The second configuration is to enable API permissions for Microsoft Graph API. The documentation available for Microsoft Graph API is great because each API request has a Permissions section that outlines the permission required for the delegated or application permissions. The example I used in my vlog was the List directReports API request where it outlines the permissions for the application permission. I used the "User.ReadWrite.All" permission.

Head over to API permissions and click on +Add a permission and select the Microsoft Graph option.

Select Application permissions.

Search for the User.ReadWrite.All permission to select it an click on Add permissions. A message will appear that confirms the permissions has been added and it will be listed.

Next grant admin consent and that will enable the API permission for the application.

For further reading on app registration, this docs.microsoft.com article provides some further explanation on what is an App Registration.

Part 2 - Using the app registration in flow within Power Automate to authenticate as an application with Microsoft Graph API

The connector to use in flow within Power Automate is the HTTP connector. This is a premium connector so you would need to ensure that you have the relevant licensing that allows you to use premium connectors.

The following is what would be configured in the HTTP action.

1 - The API request method. This is defined by the API request in the documentation for Microsoft Graph API. In my vlog I was calling the List directReports API request and the method defined in the documentation is GET.

2 - The API request as defined in the documentation is what would be inserted in this field of the action. Again, refer to the Microsoft API documentation for the API request URI that you are using. In my use case I am retrieving the list of employees that report to a specific manager so I am using the second option listed in the documentation.

The parameter id is the Object ID of the user record in Azure Active Directory and the other parameter that can be used is the userPrincipalName which is also in the user record in Azure Active Directory.

You will also notice in my screenshot that I've also referenced a select statement which will only retrieve the two properties specified which are displayName and userPrincipalName.

3 - This is using the standard definition of application/JSON as the content-Type value.

4 - Authentication is Active Directory OAuth to reference the app registration in Microsoft Azure portal.

5 - This is the Tenant ID from the app registration in Microsoft Azure portal.

6 - This is the Base Resource URI of Microsoft Graph API.

7 - This is the Client ID from the app registration in Microsoft Azure portal.

8 - The option to use is Secret.

9 - This is the Client Secret from the app registration.

Flow in action

Once the flow has been configured you're good to go in testing your HTTP action authenticating as an application with the Microsoft Graph API.

What I did demonstrate in my vlog was how the response returned as an application will be the same as the response returned through user authentication.

Summary

To authentication as an application in flow within Power Automate you can use the HTTP connector and reference details of an Azure app registration. The connectors available (such as Office 365 Users) would not be used since they authenticate as a user whereas with the HTTP connector you can define the authentication for an application to interact with the Microsoft Graph API.

If you can't grant admin rights in Microsoft Azure portal it could be it's not accessible/not allowed for some users in your organisation, check out this docs.microsoft.com documentation. Big shout out to Audrie Gordon for the tip! 💡 Subscribe to her YouTube channel, she has great content.

Catch you in the next #WTF episode

How to do Proper Case in flow

Earlier this year I faced a challenge with flow in Power Automate - I needed to make a value that was in uppercase and format it as proper case.

What is Proper Case? 

Proper Case is 

...any text that is written with each of the first letters of every word being capitalized.

For example

Hello World Today

where in bold is the first letter of the word displayed as uppercase

What's supported today with flow in Power Automate?

Proper Case is a function supported today in Canvas apps.

However with flows in Power Automate, the function does not yet exist. You can vote for the function to be made available from this Power Automate Idea.

Don't worry, in this #WTF episode I share with you how to do Proper Case with flow in Power Automate using some actions until the function is supported in flow. My brain came up with the idea to first make the value all in lowercase and then make the first letter of each word as as uppercase.

Let's flow

The following is what my flow in Power Automate looks like.

The trigger

For the purpose of learning in this WTF episode I have used the trigger of Manually trigger a flow with a text input. The text input will be where a value in uppercase will be entered and the output therefore will be used in the next action.

Compose - Split into array

The value to be transformed into Proper Case will be in uppercase - HELLO WORLD TODAY as an example. As mentioned earlier, the value will be transformed to lowercase in order to make the first letter uppercase. The first action is Compose and I am referencing a couple of functions

1. Using the tolower function transforms the value from uppercase to lowercase - note this can be skipped if your value is already as lowercase
2. Then by using an additional function of split where we split by space, an array will be formed so that we can loop through the words to make the first letter as uppercase.

The following is my expression used in the compose action.

split(tolower(triggerBody()['text']), ' ')

The following is the output of the compose action where the words in the string value is all in lowercase.

Apply to each

Since the output from the previous action is an array the apply to each action can be used to loop through the words.

Compose action - Uppercase first letter

In this action I am referencing multiple functions in a single expression. In my vlog I broke it down to explain the purpose of the different functions in the expression. What I did forget to mention though in my vlog is that I came across this expression from a Power Automate community forum post. Credit to the author of the post and not to me for this part.

The breakdown is in the following screenshot.

How to make the first letter as uppercase (#1)

To make the first letter as uppercase, two functions are used.

1. toupper will make the value as uppercase
2. by wrapping it with first function, only the first character in the value will be capitalized

The following is my expression where I'm referencing the item from the Apply to each action.

first(toupper(item()))

The output is the following where the h from hello is capitalized.

How to identify the length of the word (#2)

The purpose of this function is to know how many characters make up the word for the next two functions.

The following is my expression where I'm referencing the item from the Apply to each action.

length(item())

The output is the following where 5 is the number of characters in hello.

How to identify the difference of characters from the first letter of the word (#3)

The purpose of this function is to be able subtract the first letter, which is 1, from 5 since it is the number of characters in hello. This will make sense in the next two functions.

The following is my expression where I'm referencing the item from the Apply to each action.

sub(length(item()), 1)

The output is the following where 4 is the remaining difference when you subtract 1 from 5 (which is the number of characters in hello).

How to retrieve the remaining characters (#4)

A substring function is then wrapped around the previous expression so that from position 1 of the string value, h, the remaining characters in the string is retrieved.

The following is my expression where I'm referencing the previous two functions (2 & 3).

substring(item(), 1, sub(length(item()), 1))

The output is the following where ello is the characters retrieved.

Wrapping it altogether

Using the concat function will then combine all of the functions together to form the single expression.

The following is my expression.

concat(first(toupper(item())), substring(item(), 1, sub(length(item()), 1)))

The output is the following where the uppercase letter H is combined with ello so that the value is in Proper Case.

Join Array

I'm going to pause here as there's something I need to share and explain, Pieter's method.

Pieter's method

Pieter's method was something I didn't know of until my friend John Liu showed me. In the past whenever I've had to reference an array downstream in a flow where the array is formed from an apply to each, I've used the Initialize Variable and Set Variable actions.

Pieter's method removes the need for these two actions by referencing the output in the Apply to each in a compose action outside of the Apply to each action. In my scenario I can reference the output from the Compose action.

If you try reference the output through Dynamic Content, you won't see it.

What I did was create another Compose action within the apply to each action and referenced the output from the previous compose action.

Next step is to grab the expression by clicking on the ellipsis of the action and select peek code.

From here I copied the expression and used it in my compose action outside of the array.

Now that I know what the expression is of the output, I can use it in my join function for the Compose action. Since the capitalized words are in the form of an array, we need to 'join' them back together. This is where the join function is handy. 

The following is my expression

join(outputs('Uppercase_first_letter'), ' ')

This will result in the following as the output, hooray!

Flow in action

Time to see the flow in action 😃

Manually trigger the flow using the test feature and enter HELLO WORLD TODAY in the text input. The end result will be the words as Proper Case. Ta da!

Summary

Proper Case is a function that is not supported today but in this #WTF episode I outline what can be done in the meantime. The method I share is one way of achieving it.

Till next time 😊 #LetsAutomate

How to create a dynamic Record URL for a model-driven app

In classic workflows we can create a hyperlink in the email message content of an email activity. One neat feature is the ability to insert a Record URL to enable the recipient to click and browse to the record immediately. Now this is only relevant if that recipient is a licensed user of Dynamics 365 or CDS. If the user does not have the appropriate license, does not have the appropriate entity permissions they won't be able to view the record.

The question is: How do we replicate this classic workflows feature in a flow with Power Automate? I learnt how to do this earlier this year and Scott Durow shared a tip that he learnt from #LowCode queen Sara Lagerquist - might have been from their collab presentation at Scottish Summit 2020. In this WTF episode I'll share my method with you.

The Use Case

As the newly assigned Owner of a Case,

I want to receive an email with a hyperlink to the Case record,

so that I can easily view the Case and action accordingly.

Whenever a new Owner is assigned to a Case, an email is to be sent to the user with a hyperlink that directs them to the Case record within the Customer Service Hub app.

Understanding the URL of a model-driven app

If you look closely at the URL in your browser when viewing a record in a model-driven app it will be the following.

https://benitezheredev.crm6.dynamics.com/main.aspx?appid=fc11177c-0f6b-e811-a95c-000d3ae13628&pagetype=entityrecord&etn=incident&id=02193772-695f-4185-93f2-867abd56ac6c

This is what we want to replicate. The answers are all there in the URL staring at us. I'll break it down.

1. This is the Organisation Base URL of the instance.

2. As per the docs.microsoft.com article,  "All entity forms and views are displayed in the main.aspx page. Query string parameters passed to this page control what will be displayed." This is required to load the record within a model-driven app.

3. This is the ID of the model-driven app.

4. This defines what type of page you want to load. In this scenario the user is directed to a record, therefore the value is entity record. It also defines defines what entity you want to load where you need to reference the logical name of the entity. In this scenario it is the Case record. For more information about this please refer to this docs.microsoft.com article.

5. This is the GUID of the record you want to load.

What I'll cover next is how to retrieve 1, 3, 4 and 5 

How to identify the Organisation URL (#1)

This is straight forward. Behold, I give you Natraj's blog post.

Whenever you use a CDS action in flow with Power Automate there will be a property value of @odata.id which will contain the Organisation Base URL. Natraj's technique is to retrieve that value and apply some functions so that only the Organisation Base URL is extracted.

My expression is the following

first(split(outputs('Get_a_record')?['body/@odata.id'], '/api/'))

The functions used here is split and first.

The split allows us to separate the Organisation URL from the rest of the value. A split will result in an array and we only want the first row in the array which is where the first function comes in handy.

In my vlog I initially showed you the split function,

split(outputs('Get_a_record')?['body/@odata.id'], '/api/')

which will result in an array with two rows as the output. The first row is the Base Organisation URL.

The next action I forgot to show the run history of in my vlog. When you wrap the split function around with a first function, it will retrieve only the first row which is the Organisation Base URL.

first(split(outputs('Get_a_record')?['body/@odata.id'], '/api/'))

For your learning, I have this expression in a Compose action to demonstrate what this expression achieves. Later in the flow I use this same expression in my expression that forms the Record URL rather than the output of the

Compose since it's for educational purposes.

How to retrieve the model-driven app ID (#3)

As mentioned earlier, I learnt from the beloved Scott Durow who learnt it from the #LowCode Queen Sara Lagerquist. I now have the privilege of sharing it with you 😊

When you create a custom model-driven app, the following screen will be presented to you where you have to fill in the name and other details.

What happens behind the scenes is that a new record will be created in an entity called appmodule and each record will have an appmoduleid.

To test this out, take a look at your model-driven app URL and copy the ID you see.

In a new browser tab you're going to call the Dynamics 365/CDS API using the copied ID value.

https://YOURORG.crm6.dynamics.com/api/data/v9.1/appmodules?$filter=appmoduleid eq COPIED ID VALUE

You should now see the details of the app displayed.

Since there are multiple model-driven apps in every instance, we can narrow it down using a CDS List Records action with a filter query applied. The Name value of the model-driven app will be used to only return the appmodule so that we can retrieve the appmoduleid.

How to identify the logical name for the page type definition (#5)

Since we are loading a record, the page type value is 'entity record.'

The next part is to provide the logical name of the record. The clue is already in the Dynamics 365 record URL. It's after the "etn=" reference in the URL, this is the logical name of the entity of the Dynamics 365 record.

For more details about page type please refer to this docs.microsoft.com article.

How to retrieve the record GUID (#5)

There should be an action in your flow that has the GUID of the record you want to generate the Dynamics Record URL for. Reference the field that represents the GUID, the unique identifier.

Putting it all together

The last bit is to combine it altogether. The finishing touch is using the concat function to tie it all up.

The expression is the following.

concat(first(split(outputs('Get_User_record')?['body/@odata.id'], '/api/')),'/main.aspx?appid=',outputs('Retrieve_appmodule')?['body']?['value'][0]?['appmoduleid'],'&pagetype=entityrecord&etn=incident&id=',triggerOutputs()?['body/incidentid'])

It may look like a pile of words and characters but I'll break it down again so that it's easier for you understand and learn 😊

1. This is the expression that will retrieve the first row after we split the @odata.id value as explained earlier in this blog
post.
2. This is required to load an entity record within a model-driven app.
3. This is the expression to retrieve the ID of the model-driven app where we used a CDS List Records action to retrieve the appmodule based on the
Name of the app, Customer Service Hub. In this expression I am using one of the method's from another #WTF episode - How to Avoid the Apply to Each from appearing where we reference the first row in the output of the CDS List Records action.
4. This defines that the page type to load is entity record and the entity to load is the Case entity. The Case entity logical name is incident.
5. This is the GUID of the Case record from the trigger of the flow. When a Case record Owner is updated, it will trigger this flow.










That
is the beautiful expression!
Using the expression


I'm
using a Compose action to not only use the expression to embed the Record URL
as a hyperlink but also format the email with HTML.
The output of this
compose action is then referenced in the Description of the email activity that
is created through a CDS Create a new record action.

What my flow in Power Automate looks like


As
seen in my vlog the following is my flow.


The HTML content is a Compose action that has the expression that forms the Record URL as seen earlier in this blog post.
The last three actions are ones I have mentioned in previously #WTF episodes to create and send a CDS email activity via flow so check them out if you want to learn more about them.
Power Automate in action
Time to test the flow by assigning a new Owner to the Case record.


Awesome sauce, as you can see the Record URL created by the expression in flow successfully directs
the user to the instance of a specified model-driven app and loads the Case record.

Keeping up with Application Lifecycle Management [ALM]

This method is what I call "ALM" friendly and compatible. When you are customizing, configuring or extending Dynamics 365 or CDS it is best practice to do so in a sandbox environment such as a DEV instance. When you're ready to move your components across to a target instance such as UAT, you move it through solutions. 

When you view records across different instances like DEV and UAT, the appmoduleid will be different. If your method of forming the Record URL does not accommodate loading the app based on the instance, there's a high chance the end user will encounter the error like the following because the appmoduleid does not exist in the target environment.

By using the CDS List Records action to retrieve the appmoduleid value this method is compatible with any instance as long as

1. the entity is in the target instance. If it isn't then the hyperlink will not work
2. the name of the model-driven app is the same across all environments

The name of the model-driven app is usually the same in each instance such as DEV, UAT and Production. If the name of the model-driven app is different in each instance, then this method isn't going to work because of how the filter in the CDS List Records action uses the name value.

Other methods blogged about in our community

What I've shared with you in this #WTF episode is one way of forming the Record URL in flow with Power Automate. Linn Zaw Win shared his method in his blog post. 

Summary


By
using a functions in a single expression you can form the Record URL and embed
it as a hyperlink for a CDS email activity or even a Microsoft Teams message.



Catch you in the next #WTF episode



Don't forget to do a shout on Twitter or leave a comment in my vlog if this has
helped you out 🤗

PDF Automation series - Part 3: How to automate generating a PDF and attach to an outbound email

The final of my PDF Automation series covers how to use the custom connector for Dynamics 365 to automate generating a PDF and attach to an outbound email. Refer to the following as a prerequisite to what the previous two WTF episodes covered which will be reference in this finale of my PDF Automation series.

• Part 1: How to create a Word Template in Dynamics 365
• Part 2: How to create a custom connector for Dynamics 365

**I'd like to make it clear that as of today, Convert to PDF is configured and supported in the Dynamics 365 Sales Hub app**

In this WTF episode I will cover the flow in Power Automate that references the Document Template record from Part 1 and the custom connector for Dynamics 365 from Part 2.

Use Case

Before we jump into the How To's, a reminder that the use case for this series will be

As a customer,

I want to receive a Tax Receipt of my purchase in an email,

so that I have confirmation of my purchase.

The life cycle of the process will be

1. A Dynamics 365 Invoice record is updated to paid.
2. My flow in Power Automate is triggered that handles all the magic.
3. The customer associated to the Invoice will receive an email with a PDF attached that represents their Tax Receipt.

What my flow in Power Automate looks like

My flow uses the custom connector and both actions that you would have read/seen in Part 2: How to create a custom connector for Dynamics 365. The flow is created in a solution and I'm using the CDS current environment connector.

1.0 Trigger - When an Invoice is updated to Paid

The trigger is when the status reason is Updated to Paid where the end user in the Dynamics 365 Sales Hub App clicks on Invoice Paid in the ribbon. 

I have also configured two filters for the trigger

1. Only trigger if the Status Reason field has been updated
2. And if the Status Reason field equals Paid

1.1 Retrieve queues

Using the CDS List records action I am retrieving a Queue with the name of "No Reply" as defined in my Filter Query field. To learn more about the configuration required to be able to send from a Queue, refer to Episode 23 -  Sending an email from a Queue with Power Automate.

1.2 Create a new email activity record

Using the CDS Create a record action an email activity will be created where the sender will be the Queue from 1.1 Retrieve queues and the To recipient is the customer of the Invoice.

I've cut out area of the action as some it is not used otherwise it would have been a long screenshot 😅 The other configuration is providing a Description, setting the Regarding value to the Invoice and the Subject of the email.

1.3 Retrieve Document Template record

Using the CDS List records action I am retrieving a Document Template record where I had uploaded a Word Template I created. This would be Document Template record from Part 1. This will be the template used to generate the PDF for an a paid Invoice where it includes information such as the customer, the bill to address, the invoice items and so forth.

The filter query is the name of the Document Template record.

1.4 Generate PDF

Woo hoo! This is where the action created in the custom connector is used. The Generate PDF action is used where the values are provided for the JSON payload of the API request. I covered this in Part 2.

• The EntityTypeCode represents the entity that the PDF will be generated against. In my use case it is the Invoice entity where the value is 1090.
• The @odata.type is Microsoft.Dynamics.CRM.documenttemplate
• The documenttemplateid is the GUID of a Document Template record. Refer to Part 1. My expression since the CDS List record action is used to retrieve the Document Template record is the following to avoid the Apply to Each from appearing

outputs('1.3_Retrieve_Document_Template_record')?['body/value'][0]?['documenttemplateid']

• The SelectedRecords property is the GUID of the Invoice record from the trigger that the PDF will be generated against. I included the additional characters the API request expects which I explained in Part 2.

1.5 Create Email Attachment

The other custom action used is creating an activitymimeattachment record by 

• binding to an email message which is from 1.2 Create a new email activity record action
• referencing "email" as the objecttypecode
• using the base64 PdfFile property in the JSON response of 1.4 Generate PDF action
• using the Invoice ID from the trigger as the file name and subject
• note that for the file name ".pdf" is used as the file format

1.6 Perform a bound action

The last step is the CDS Perform a bound action using the SendEmail action. Simply reference the email message from 1.2 Create a new email activity record and set the IssueSend value to Yes.

Power Automate in action

Update an existing Invoice to Paid and refresh to see the email activity created with a PDF that represents a Tax Receipt.

Unit testing

The following are screenshots to confirm the attachment record was correctly created. I mentioned in Part 2 that I learnt from this forum post of how the activitymimeattachment should be created first where Dynamics 365 will then create the corresponding attachment record.

This was the Invoice that was updated to Paid.

Here's the activitymimeattachment response from the custom connector. The activitymimeattachment was successfully created.

I queried the activitymimeattachment API to retrieve the record details. 

1. The activitymimeattachmentid matches the id from the response.
2. I can see the corresponding attachment record was created too.
3. I can also see the activitymimeattachment record was binded to the created email activity.

I queried the attachment API to retrieve the record details. I can see the attachmentid matches the property value from the activitymimeattachment record and the filename and subject matches the Invoice ID.

Lastly, I queried the emails API to retrieve the record details. I can see that the activityid value matches the _objectid_value from the activitymimeattachment and that the Invoice ID referenced in the email subject matches the paid Invoice. It all ties together nicely 👍

Another handy blog post

Another blog post you can refer to that has a different flow in Power Automate but achieves the same result is by another Microsoft MVP in our community, Aric Levin which you can read here. What I like about Aric's blog post is that it would be an option for customers who use CDS but not Dynamics 365 as the Convert to PDF functionality as of today resides in the Dynamics 365 Sales Hub app. Aric also uses the Office 365 action to send the email with the generated PDF file which means the storage consumption of CDS will not be impacted. The exception is if the App for Outlook is installed and tracking is enabled which means the sent email from Outlook may be created as an email activity based on the configuration of tracked emails for the user.

Summary

Automating generating PDFs from the Dynamics 365 Sales Hub app is achievable with Power Automate through

1. A Word Template uploaded against a Document Template record
2. A custom connector for Dynamics 365 that calls the ExportPdfDocument API and the activitymimeattachment API
3. A flow that references the Document Template from No.1 and use the custom actions created in the custom connector for Dynamics 365 from No.2

I hope you enjoyed my PDF Automation series 🙂

Your Vote Counts!

If you want Convert to PDF across custom entities then vote for this Dynamics 365 Idea to gain momentum. I would love to see this functionality across the Dynamics 365 platform so let's do our part by voting for it.

via GIPHY

Where my Starship Troopers fans at?! 😁