What lives here
- Workflows app in Teams: templated flows (the webhook-post template serv365 itself uses, scheduled posts, approvals-adjacent automations) created from inside Teams but LIVING in Power Automate — an environment, an owner, a connection, a licence context.
- Approvals app: structured request/approve records in Teams, built on the same platform (and Dataverse for Teams underneath).
- Adaptive Cards: the lingua franca — bots, flows and webhooks all post cards; card actions can round-trip data back into flows.
- Dataverse for Teams: the lightweight data layer behind Teams-native Power Apps — real enough to hold business data, governed via Power Platform.
The governance handshake (the part everyone misses)
A workflow posting into Teams answers to Power Platform governance, not Teams governance: environment routing, DLP connector policies (may the Teams connector talk to that SQL connector?), and flow-owner lifecycle (the flow dies quietly when its owner leaves — serv365's own delivery-doc caveat, generalised to every flow your business builds). Meanwhile Teams governance decides only whether the Workflows APP itself is available to users (app policies, previous concepts). Real control = both consoles.
serv365's tenant scan reads the Power Platform surface (environments, DLP) — the drift alert when someone creates an ungoverned environment is the early warning that shadow automation is nesting.
What to watch (proofs)
- The flow inventory: Power Automate admin center per environment — flows using Teams connectors, their owners, their run history; the orphaned-owner report is the future-outage list.
- DLP truth: Power Platform DLP policies (in your scan) — which connector groups may combine; a Teams+external-storage combination appearing is the exfiltration-path alert.
- A specific card's provenance: posts by the Workflows/Flow bot name the flow — trace from the channel post to the flow's run history for the "what posted this" question.
- Run failures where users see silence: the flow's 28-day run history — the webhook that "stopped working" almost always shows a red run with the reason.