Cloud flows, desktop flows and RPA

Cloud flows — three trigger styles

Cloud flows run in the Power Automate service and act through connectors (APIs). They differ only by trigger:

All three carry the same governance shape: they use connections (stored credentials), they are bounded by DLP, and they can move data between systems.

Desktop flows (RPA)

Desktop flows are robotic process automation — they drive the UI of desktop and web applications (clicking, typing, screen-scraping) via Power Automate Desktop, for systems with no API. They run on a machine (attended, alongside a signed-in user, or unattended, on a server with a stored credential), not purely in the cloud. Attended vs unattended and hosted machines have their own premium/RPA licensing.

Failure modes

• Unattended RPA runs as a stored human credential. An unattended desktop flow logs in as a real user account to drive apps — that credential is a standing, high-value secret, and the bot inherits everything that user can do.
• Screen-scraping breaks silently. UI automation is brittle; a layout change can make a flow do the wrong thing rather than fail cleanly.
• Scheduled flows outlive their purpose. A recurrence set up once keeps running (and consuming) long after anyone remembers why.
• Instant flows called from apps blur the app/flow boundary — the flow's connection permissions, not the caller's, decide what happens.

What to watch (proofs)

• Flow inventory by type and state: Get-AdminFlow lists cloud flows per environment with enabled/suspended state; the admin center distinguishes desktop flows and machine/machine-group registrations.
• Unattended RPA and their run-as accounts: desktop-flow machine registrations and the stored credentials behind them — the standing-secret surface.
• Recurrence sprawl: scheduled flows and their last-run/trigger history (Get-AdminFlow + run history) — long-idle or high-frequency jobs.
• Connector reach per flow: which connectors each flow binds (Get-AdminFlow details) vs DLP — the exfil bound.