An HTTP-triggered flow anyone with the URL can run

HTTP-triggered flow can be run by anyone with the URL.

The flow's trigger accepts anyone with the URL, no identity check, so a leaked link lets anyone drive whatever the flow does in Dataverse. Power Automate now defaults new flows to tenant-restricted.

Export the solution and search the flow definition JSON for request triggers, then read the authentication setting on each. Older flows predate the tenant-restricted default, so age is a good filter for where to look first.

Restrict the trigger to your tenant or named users, and regenerate the signature key so old URLs stop working.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A credential stored in a plugin step's unsecure configuration
• A webhook or service endpoint using plaintext HTTP
• A webhook registered without any authentication