Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Before performing a DSR, you must identify where the user's Workflows data resides.
Identify the scope
Locate the Environment: Navigate to the Power Platform admin center, Inventory.
Check two locations. Workflows artifacts are typically in one of two places:
- The default environment of the tenant or user's Personal Development Environment (PDE).
- M365 Copilot Workflows environment (for new flows created after April 2026).
Go to Inventory, filter by the user's email, and make a note of the Environment ID where their Workflows agents are listed. You'll either see an environmentID value in the Environment ID column, which corresponds to ID of PDE/Default environment. OR, a URL link containing the environmentID of M365 Copilot Workflows environment in your tenant.
DSR on M365 Copilot Workflows environment
DSR on M365 Copilot Workflows environment is strictly API-based. Once you have necessary roles mentioned in the following table, you can reference the DSR Compliance table to perform DSR operation on M365 Copilot Workflows environment.
API permissions setup
Learn more about permissions needed for API access in Role-based access control (RBAC) permissions.
The following table provides specific permissions for Workflows agent DSR.
| Role name | Role ID | Description | Assignable scope |
|---|---|---|---|
| Workflows agent Data Subject Rights Environment Reader | 38a014c1-0485-4e5e-b784-782ea373b34b |
Grants full access to perform read operations for Data Subject Rights requests for Workflows agent flows for a given environment. | /tenants/{0}/environments/{1} |
| Workflows Agent Data Subject Rights Administrator | 363ee124-fdb2-406f-9272-ebf239730ed2 |
Grants full access to perform read and delete operations for Data Subject Rights requests on Workflows Agent Flows | /tenants/{0} |
Find a tutorial for customers in Assign roles to service principals.
DSR on PDE/Default environment
Each Workflows agent's workflows are backed by specific Dataverse entities. Because these aren't surfaced in the standard Power Automate UI, you must use the following methods to locate them.
Method A: Web-based management (UI)
For a manual, UI-based approach, navigate to the environment identified in Identify the scope and use the Tables view in Power Apps or the maker portal.
In the identified environment, refer to the following Dataverse entities on the environment to perform DSR export/delete.
| Target data | Dataverse table |
|---|---|
| Process | Workflows (Category 5: Modern Flow and ModernFlowType: M365CopilotFlow) |
| Process | AI Flows (Category 7: AI Flow) |
| ConnectionReference | Connections |
| AI Model | AI Prompts - AI Model |
| AI Configurations | AI Prompt Prompt Data |
| WorkflowMetadata | WorkflowMetadata |
| FlowRun | Flow Run (If Flow Run Ingestion is enabled) |
| AI FlowRun | Flow Run |
| Approvals | Approvals (Subject to a 28-day automatic deletion retention policy) |
Method B: API-based management (bulk/automation)
If you're handling multiple requests, use the environment-scoped APIs.
| API | Notes |
|---|---|
| Get Conversation Transcripts With Environment | Get conversation transcripts for DSR export (environment-scoped). |
| Get Flow Run Actions With Environment | Get flow run actions for DSR export (environment-scoped). |
| Get Flow Runs (default/PDE) | Get flow runs for DSR export (environment-scoped). |
| Get Run History Data (default/PDE) | Get run history customer data for DSR export (environment-scoped). |
API permissions setup
Learn more about permissions needed for API access in Role-based access control (RBAC) permissions.
The following table provides specific permissions for Workflows agent DSR.
| Role name | Role ID | Description | Assignable scope |
|---|---|---|---|
| Workflows agent Data Subject Rights Environment Reader | 38a014c1-0485-4e5e-b784-782ea373b34b |
Grants full access to perform read operations for Data Subject Rights requests for Workflows agent flows for a given environment. | /tenants/{0}/environments/{1} |
Find a tutorial for customers in Assign roles to service principals.
Export
Admins can export all data pertaining to a user's usage on Workflows agents. Learn more in the following articles:
Delete/Reassign
Admins can delete/reassign Workflows agents created by a user. Learn more in Reassign and copy the user's flows.
The following list contains resources about DSR requests: