Maker Offboarding Resource Transfer

Overview

This scheduled cloud flow automates the reassignment of Power Platform resources (apps, flows, chatbots, and other assets tracked in a maker inventory) when a maker leaves the organization or is disabled in Entra ID. It discovers every resource still owned by the departing user in the Dataverse maker inventory table, requests manager approval to reassign ownership, records the transfer, and posts a confirmation in Teams so the governance channel has a clear audit trail.

The flow ships in Off state and is intended to run daily on a recurrence trigger. Swapping the recurrence trigger for an Entra ID "When a user is created, updated, or deleted" trigger is a supported customization — the core logic (discover → approve → update → notify) remains unchanged.

Use Case

When a maker is disabled or offboarded, any Power Platform resources they own must be reassigned before access controls lock them out entirely. Orphaned resources create compliance risk, break downstream automations, and prevent the app/flow from being edited. This flow removes the manual toil from IT admins by driving a per-resource approval to the departing user's manager, letting the manager either take ownership themselves or reject and nominate someone else.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Swap the trigger

Replace Recurrence_Daily with the Entra ID 'When a user is updated' trigger and gate it on accountEnabled flipping from true to false. Bind flowlibs_DisabledUserUPN to the trigger's userPrincipalName.

Use a distribution list for approval

Point Start_Approval_For_New_Owner's assignedTo at a governance DL instead of outputs('Get_Manager')?['body/mail'] if your org routes all offboarding decisions to a central team.

Record rejection reasons

Add a branch to the If_Approved action's else block that captures body/responses[0]/comments and writes it to a new column on the inventory row. Keep flowlibs_transferstatus = Pending so the next run re-opens the conversation.

Harden against empty inventory

Wrap Apply_To_Each_Owned_Resource in a Condition checking length(outputs('List_Owned_Resources')?['body/value']) > 0 to avoid posting a 'no resources found' notice every day once offboarding is complete.

Integrate the Admin Center PowerShell

For true app/flow ownership reassignment (beyond inventory bookkeeping), add an HTTP action calling a custom connector wrapping Set-AdminFlowOwnerRole / Set-AdminPowerAppOwner. Chain it after Update_Inventory_Record.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{concat('flowlibs_ownerupn eq ''', variables('varDisabledUserUPN'), ''' and flowlibs_transferstatus eq ''Pending''')}

@{concat('Departing maker: ', outputs('Get_Departing_User_Profile')?['body/displayName'], ' (', variables('varDisabledUserUPN'), ').\n\nResource to transfer: ', items('Apply_To_Each_Owned_Resource')?['flowlibs_name'], ' (', items('Apply_To_Each_Owned_Resource')?['flowlibs_resourcetype'], ').\n\nPlease approve to designate yourself as the new owner, or reject and reply with the UPN of the proposed new owner.\n\nDeadline: ', variables('varApprovalDeadlineDays'), ' days.')}

@{concat('<p><strong>Maker Offboarding — Resource Transferred</strong></p><p>Resource: <b>', items('Apply_To_Each_Owned_Resource')?['flowlibs_name'], '</b> (', items('Apply_To_Each_Owned_Resource')?['flowlibs_resourcetype'], ')</p><p>Previous owner: ', variables('varDisabledUserUPN'), '</p><p>New owner: ', outputs('Get_Manager')?['body/mail'], '</p><p>Transfer date: ', utcNow(), '</p>')}

item/flowlibs_newownerupn : @outputs('Get_Manager')?['body/mail']
item/flowlibs_transferdate : @utcNow()
item/flowlibs_transferstatus : Completed