Collaborator Access Audit

Overview

FlowLibs - Collaborator Access Audit is a scheduled Power Automate Cloud Flow that performs a weekly governance audit comparing expected repository collaborators (maintained in a SharePoint list) against the actual collaborators configured on a GitHub repository. Any expected user who is missing from GitHub is reported in a consolidated HTML email sent to an IT Admin recipient. The flow ships Off and is fully portable across tenants — every external resource pointer is an environment variable.

Use Case

Small engineering teams and IT Admin groups often grant GitHub repository access on a case-by-case basis, and there is no built-in mechanism to ensure the *intended* roster (as maintained in a source of truth like SharePoint) matches what is actually provisioned on each repository. This flow closes that gap: once a week it walks the expected roster, checks each user against the live GitHub collaborator list, and produces a single audit email highlighting users who are missing access. Admins receive zero noise when everything is compliant, and an actionable list of exceptions when it isn't.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Deploy in a new tenant

Import the solution, set the five environment variable values for your target environment, authorize the three connection references (SharePoint, GitHub, Office 365 Outlook), then turn the flow On. No expression-level edits are required.

Tailor the SharePoint audit list

The flow reads the Title column from the list and uses it as the GitHub login. Add columns such as Email, Role, or Notes to enrich the discrepancy email body — the HTML-row expression in Append_Discrepancy_Row can be extended to pull additional columns.

Adjust the schedule

Edit the Recurrence trigger. The default is weekly Monday at 09:00 Eastern. For daily audits, change to Daily frequency and update weekDays accordingly.

Change the recipient

Update the flowlibs_AuditAlertRecipient env var value. Multiple recipients can be added by switching the Outlook To-address expression to a semicolon-joined string.

Expand to multiple repositories

Wrap the GetItems/ListCollaborators/Foreach subsequence in an outer Foreach over a list of repositories stored in a separate SharePoint list, and parameterize varGitHubOwner and varGitHubRepository inside the loop.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

frequency: Week
interval: 1
timeZone: Eastern Standard Time
schedule: { hours: [9], minutes: [0], weekDays: [Monday] }
startTime: 2026-04-20T09:00:00

@filter(
  body('Get_Actual_Repository_Collaborators_From_GitHub'),
  equals(
    toLower(item()?['login']),
    toLower(coalesce(items('For_Each_Expected_Collaborator')?['Title'], ''))
  )
)

@equals(length(body('Filter_Actual_For_Expected_Username')), 0)

@{concat('<tr><td>', coalesce(items('For_Each_Expected_Collaborator')?['Title'], ''), '</td><td>', coalesce(items('For_Each_Expected_Collaborator')?['Email'], ''), '</td><td>', coalesce(items('For_Each_Expected_Collaborator')?['Notes'], ''), '</td></tr>')}

@greater(variables('varDiscrepancyCount'), 0)