Before Lab 5.3 — Power Automate Approval Flow
Before Lab 5.3 — Power Automate Approval Flow
In Lab 5.2, you assigned Azure Policy guardrails. In Lab 5.3, you will connect those policies to Power Automate — creating a flow that detects violations, asks for human approval, and then acts.
The problem with blind automation
Azure Policy remediation tasks (Lab 5.5) are powerful — but they act without human judgment. What if the fix is wrong? What if the resource is critical and needs to stay public for one more hour?
The solution: Add a human in the loop. Detect the violation, ask someone to approve the fix, then auto-remediate on their behalf.
For the full Auto-Remediate vs Alert-Only decision framework, see the Security Automation theory page.
How it works
Power Automate approval flow pattern
The standard pattern for a Power Automate approval flow is:
- Trigger: When a condition is met (e.g., Azure Policy violation detected)
- Condition check: Is this safe to auto-fix? (Yes/No based on severity, scope, etc.)
- If Yes: Send approval request via Teams/email
- If approved: Execute the remediation action
- If rejected: Log the violation and alert for manual review
Why Teams? Teams notifications are fast, visible, and don't require opening email. The approver can act from their desktop or mobile without leaving their workflow.
What you will do in this lab
You will build a Power Automate flow that:
- Triggers when Azure Policy flags a non-compliant resource (e.g., public blob access enabled — use the Deny public blob access policy from Lab 5.2)
- Sends an approval request to the resource owner via Microsoft Teams
- Auto-remediates if the owner approves (disables public access)
- Logs the violation if the owner rejects it
Important timing note
After assigning policies in Lab 5.2, Azure needs time to evaluate existing resources and flag violations — typically 15–30 minutes. If you try to trigger the Power Automate flow immediately after Lab 5.2, there may be no violations yet. Check your policy compliance status first before proceeding.
What to look for in Lab 5.3
Lab 5.3 checklist
Lab focus
In Lab 5.3, you are adding human judgment to automated responses. The goal is to close the gap between pure automation and pure manual processes — getting the best of both worlds.
Check before starting
You should be able to answer these questions before starting the lab:
- When should you use a human approval flow instead of auto-remediation?
- Why is Teams a good channel for approval requests?
- What happens if the approver doesn't respond within the timeout period? (In practice, Power Automate approvals have a configurable timeout after which the approval expires and the Reject path is taken.)