Dropbox Shared-Link Access Audit

Overview

This flow surfaces risky Dropbox sharing for governance. On a daily schedule it lists every shared link in the account and the members of a monitored shared folder, flags links whose resolved visibility is public and folder members whose email is outside the internal domain, logs each finding to a Dataverse audit table, and posts a summary with remediation suggestions to a security Microsoft Teams channel.

Why it matters: public Dropbox links and external collaborators silently leak data. Automated, scheduled auditing catches over-sharing before it becomes an incident and gives security a durable, queryable record in Dataverse.

Ships Off (demo). The Dropbox reads use the Business Sharing API via HTTP (the connector lacks those operations).

Use Case

Security wants ongoing visibility into externally shared Dropbox content without manually trawling the admin console. This flow runs unattended each morning, writes one Dataverse row per risky finding (public link or external folder member), and alerts the security channel with counts and concrete next steps.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Auto-remediate

After each public-link finding, call POST /2/sharing/revoke_shared_link (HTTP) to revoke the link automatically.

Owner notice

Add an Outlook SendEmailV2 to email the file owner about each finding.

Enforce expiry

Call POST /2/sharing/modify_shared_link_settings to apply an expires timestamp on sensitive links.

Scope

Populate the shared-folder id and extend to multiple folders by wrapping the member scan in a Foreach over the parsed monitored-folders list.

Severity routing

Branch on visibility to send high-risk public links to a different channel or an Approvals gate.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

equals(items('Apply_to_each_Shared_Link')?['link_permissions']?['resolved_visibility']?['.tag'], 'public')

not(endsWith(toLower(items('Apply_to_each_Folder_Member')?['user']?['email']), toLower(concat('@', variables('varInternalDomain')))))

coalesce(items('Apply_to_each_Shared_Link')?['name'], 'Untitled shared link')

guid()