My ideal scenario would be the ability to register an individual FME Flow App as a Microsoft Entra ID application.
When a Flow App is intended only for internal use, the app could require users to sign in with their Microsoft 365 account before they can access it. Authentication and access could then be controlled through Microsoft Entra ID, including:
- Microsoft 365 sign-in
- Multifactor authentication
- Conditional Access policies
- Assigned users or Entra ID groups
- Application roles or group-based permissions
- Centralized access revocation and audit logging
Most importantly, users who only need to run a Flow App would not need to be created or provisioned as FME Flow users. FME Flow administrators and workspace authors could continue using regular FME Flow accounts, while end users would authenticate directly to the specific Flow App through Entra ID.
A typical workflow could be:
- An administrator registers the FME Flow App in Microsoft Entra ID.
- The administrator assigns permitted users or groups to the application.
- A user opens the Flow App URL.
- If the user is not already signed in, the app redirects them to Microsoft sign-in.
- After successful authentication, the user can access the Flow App without having an FME Flow account.
This would create a clear separation between:
- FME Flow administrators and authors, who require FME Flow accounts; and
- Flow App consumers, who only need permission to use a specific application.
It would make internal FME Flow Apps much easier to secure, govern, and deploy. It would also allow organizations to publish separate public and internal Flow Apps while using their existing Microsoft 365 identity and security controls for internal access.