managing power automate desktop on windows

1 Whitepaper: Managing Power Automate Desktop on Windows

Managing Power

Automate Desktop on

Windows

Summary: This playbook introduces you to the concept of managing lifecycle for Power

Automate Desktop, leveraging Microsoft Endpoint Manager tools such as Intune, SCCM and ring

deployment techniques to deploy, monitor and audit Power Automate Desktop. Watch the

video series for this playbook as well.

Writers: Thomas Barcenas (KMicro Tech, Inc.)

Technical Contributors: Apostolis Papaioannou, Ashvini Sharma, Costas Chamosfakides,

Gautier Chastan, Kathy Osborne, Kent Weare, Pranav Rastogi, Quentin Sele Barancy

Published: August 2021

Version: 1.0

This document is provided “as-is.” Information and views expressed in this document, including

URL and other Internet Web site references, may change without notice. You bear the risk of

using it. Some examples are fictitious and are for illustration only. No real association is intended

or inferred. This document does not provide you with any legal rights to any intellectual

property in any Microsoft product.

© 2021 Microsoft Corporation. All rights reserved.

https://aka.ms/padonwindowspnpvideo


Table of Contents Forward ......................................................................................................................................................... 3

Prerequisites ............................................................................................................................................. 3

SCCM Deployment ........................................................................................................................................ 4

Requirements ............................................................................................................................................ 4

Set up network share ................................................................................................................................ 4

Install application on a test machine ........................................................................................................ 7

Build application package ......................................................................................................................... 8

Distribute application package ............................................................................................................... 27

Create device collection .......................................................................................................................... 33

Add devices to device collection ............................................................................................................. 41

Deploy application .................................................................................................................................. 44

Monitoring deployments ........................................................................................................................ 53

SCCM lifecycle management ...................................................................................................................... 55

Update to the latest version ................................................................................................................... 55

Ring deployment ..................................................................................................................................... 62

Intune deployment ..................................................................................................................................... 65

Requirements .......................................................................................................................................... 65

Create Azure security group ................................................................................................................... 65

Install application on a test machine ...................................................................................................... 66

Create content prep tool directories ...................................................................................................... 67

Build application package ....................................................................................................................... 68

Deploy application .................................................................................................................................. 71

Silent registration for machines .............................................................................................................. 78

Intune lifecycle management ..................................................................................................................... 80

Update to the latest version ................................................................................................................... 80

Ring deployment ..................................................................................................................................... 82


Forward These procedures will help guide you through the process of deploying Power Automate

Desktop to Windows 10 using either SCCM or Intune.

1. SCCM

a. Deployment – Consisting of the initial install of Power Automate Desktop onto

Windows 10 machines that currently do not have Power Automate Desktop

deployed.

b. Lifecycle Management - Consisting of the scenario where automatic updating is

either unavailable or disabled.

2. Intune

a. Deployment – Consisting of the initial install of Power Automate Desktop onto

Windows 10 machines that currently do not have Power Automate Desktop

deployed.

b. Lifecycle Management - Consisting of the scenario where automatic updating is

either unavailable or disabled.

Prerequisites • A Microsoft work or school account to sign into Power Automate

• An account with administrator privileges to sign into your Windows device

• System requirements:

o A device that runs Windows 10 Home, Windows 10 Pro, Windows 10 Enterprise.

ARM devices are not supported.

▪ Minimum hardware

• Storage: 1GB

• RAM: 2GB

▪ Recommended hardware

• Storage: 2GB

• RAM: 4GB

▪ .NET Framework 4.7.2 or later

• Read the terms and conditions: https://docs.microsoft.com/dynamics365/legal/slt-

power-automate-desktop

• Download the Power Automate Desktop Installer:

https://go.microsoft.com/fwlink/?linkid=2102613

• Reference https://docs.microsoft.com/power-automate/desktop-flows/install to verify

none of the command line arguments have changed.

https://docs.microsoft.com/dynamics365/legal/slt-power-automate-desktop

https://docs.microsoft.com/dynamics365/legal/slt-power-automate-desktop

https://go.microsoft.com/fwlink/?linkid=2102613

https://docs.microsoft.com/power-automate/desktop-flows/install


SCCM Deployment

Requirements Step-by-step instructions on setting up your Endpoint Configuration Manager Site Servers and

Roles is outside the scope of this document. At a high level you will need the follow

prerequisites already configured to follow the steps in this document:

• Microsoft Endpoint Configuration Manager

o Running the latest servicing update required to manage your deployed Windows

10 version

o A reachable distribution point (or a fallback point) to distribute software from

• A network share which is accessible to SCCM where you can store application installers,

for example: \\<File Server>.contoso.com\sources\

Set up network share In this section, our goal is to get the power automate desktop installer copied to the network

share where it can be built into a Configuration Manager Application. We will need the full UNC

path for a later step when we build the application in Configuration Manager

1. View the properties of your Power Automate Desktop application installer and go to the

Details tab.

2. Make a note of the Product Version.


3. In your application installers network share, create a Power Automate Desktop folder.

4. Inside your Power Automate Desktop folder, create a subfolder with the version of Power

Automate Desktop.


5. Copy your installer executable into the Version folder.

6. Shift + right click your setup file, then choose Copy as Path.


7. Paste the path into a scratch Notepad; you will need it later.

Install application on a test machine This step is required to get the detection method settings for building the package.

1. Install Power Automate Desktop on a test machine.

2. Find the MSI product code in the registry at this location:

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\


3. Copy the path and paste it into Notepad.

4. Copy the DisplayVersion and paste it into Notepad.

Build application package In this section we will create the actual application package we can deploy to endpoints.

1. Open the Configuration Manager Console and browse to Software Library and

expand Application Management.


2. Optionally, create a Power Automate Desktop subfolder under Applications; otherwise

you can use the root of Applications.


3. Right-click either your subfolder or Applications and click Create Application.


4. On the General screen of the Create Application Wizard, select Manually specify the

application information and click Next.

5. On the General Information screen, fill out the following fields: Name, Publisher,

Software Version, and Date Published.

6. Click Next.


7. We will not be using the Software Center in this package; click Next.


8. On the Deployment Types screen, click Add.


9. In the Create Deployment Type Wizard, select Manually specify the deployment

type information and click Next.


In the General Information screen, enter a Name and click Next.


10. Paste the network share information from Set up Network Share into the Content

location field.

11. Paste the following text (without the quotation marks) into Installation program:

“Setup.Microsoft.PowerAutomateDesktop.exe -Silent -Install -


ACCEPTEULA”


12. Paste the following text (without quotation marks) into Uninstall program:

“Setup.Microsoft.PowerAutomateDesktop.exe -Silent -Uninstall”

13. Click Next.

14. On the Detection Method screen, click Add Clause.


15. In the Detection Rule dialog box:

A. Select the Setting Type drop down and choose Registry.

B. Select Hive.

C. In the Key field, paste the following text (without the quotation marks):

“SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Unin

stall\{092D4935-1864-44F0-921C-374B4BF13126}”

D. In Value, enter DisplayVersion.

E. For Data Type select String.

2. Select This registry setting must satisfy the following rule to indicate the presence

of this application and set the Value to the version number of Power Automate


Desktop.

A. Click OK.

B. Click Next.

16. On the User Experience screen, for Installation behavior, select Install for System.

17. For Logon requirement, select Only when a user is logged on.

18. For Installation program visibility, select Hidden.

19. For Maximum allowed run time (minutes) enter 30.

20. For Estimated installation time (minutes) enter 15.

21. Click Next.


22. Do not change the Requirements screen; click Next.


23. Do not change the Dependencies screen; click Next.

24. On the Summary screen, click Next.


25. On the Completion screen, click Close.


26. You will be taken back to the Deployment Types screen in the Create Application

Wizard. Click Next.

27. On the Summary screen click Next and wait for the application to be built.


28. Once it finishes click Close.

Distribute application package 1. Right-click your newly-created application package and select Distribute Content.


2. Click Next.


3. On the Content tab, click Next.


4. On the Content Destination screen, click Add and select all distribution points where

you will be deploying Power Automate.


5. On the Summary tab click Next.

6. Click Close.

7. Select Power Automate and click Content status in the main pane to verify that your

content has been distributed.


Create device collection 1. Browse to Assets and Compliance > Device Collections.

2. Optionally, create a folder for Power Automate Desktop to organize any device collections

you’ll use in the future


3. Create a new collection by right-clicking the folder and selecting Create Device Collection.

4. In the Create Device Collection Wizard:


5. Name the collection, and make sure to include the version of Power Automate Desktop in

the name.

6. Set Limiting collection to All Desktop and Server Clients. (Optionally in more advanced

use cases, you can limit this to only workstations. Explaining limiting collections is outside


the scope of this document.)

a. Click Next.

7. In the Membership Rules tab, do not add membership rules for now. (The logic for

organizaing memberships will be covered in a later section.)


8. Deselect Schedule a full update on this collection, and click Next.


9. Click OK in the warning message.


10. On the Summary tab, click Next.

11. Click Close.

Add devices to device collection You can add devices as a direct rule, where you will tie a specific device to the device collection,

and it stays there. This is absolutely a viable method for deployment. The draw back to this

approach is that new devices won’t be automatically added to your device collection, so some

work will be needed going forward to maintain the correct device collections to make sure new

computers are added to the collections on an on-going basis.

More advanced deployments might make use of something called a “Query Rule” where you

filter by OS version, or even possibly create a device collection where it can automatically add all


devices that have Power Automate Desktop installed. Please check the Microsoft documentation

on creating Query rules for more information: Create queries in Configuration Manager

1. Browse to Assets and Compliance > Devices.

https://docs.microsoft.com/mem/configmgr/core/servers/manage/create-queries


2. Find the device you want to add to the device collection, right-click it, and select Add

selected items > Add selected items to existing device collection.


3. Find the device collection you just created and click OK.

Deploy application 1. Browse to Software Library > Applications and find your Power Automate Desktop

installation package you created earlier.


2. Right-click it and select Deploy.

3. Add the device collection you created in the previous step (make sure to change the

drop-down to Device Collections from User Collections) and click Next.


4. Review the the Content tab, and click Next if everything looks correct.


5. On the Deployment Settings tab, change the Purpose drop-down to Required and

then click Next.


6. On the Scheduling tab, you may schedule the deployment for a specific time or you can

select As soon as possible. For this example, select the default (As soon as possible).


Then click Next.

7. On the User Experience tab, change the User Notifications drop-down to Hide in

Software Center and all notifications, then select Software Installation. Then click

Next.


8. On the Alerts tab, click Next.


9. On the Summary tab, click Next.

10. Click Close.

Monitoring deployments To check the status of a deployment, browse to Monitoring > Deployments then search for

Power Automate Desktop.

You should get a breakdown of how your deployment is doing across your device collection.

Keep in mind, these deployments are not updated in real time and you may need to wait several

minutes before the information is updated.

Once the installation is completed, you should see a successful deployment, as shown below.


SCCM lifecycle management

Update to the latest version 1. Follow all steps in SCCM deployment to build the application package with the latest

version. Your Software Library should then have a new application package with the newest

version, as shown below.


2. Right-click to edit the new application package and go to the Supersedence tab.


3. Click Add, then click Browse.


4. Select the old version you want to replace and click OK.


5. In the New Deployment Type drop-down, select the new version of Power Automate

Desktop, select Uninstall, and click OK.


6. Click OK to close the Properties window.


7. Deploy the new version to your device collection. It will automatically replace the old version

on the PCs in the device collection.

8. Optionally, after you are no longer deploying the older version on any machines, you can

remove any deployments for it by right-clicking the obsolete deployment in the


Applications section of the Software Library and selecting Delete.

Ring deployment Ring deployment is a methodology where you first deploy newer versions to select test, pilot,

and production groups. Basically, you deploy to a small number of endpoints, then a larger

number, and continuing for as many rings as make sense for your environment until you have


deployed to all users, as shown in the diagram:

To fully manage the lifecycle in SCCM, create three deployment rings for Power Automate

Desktop.

• Power Automate Desktop Canaries

• Power Automate Desktop Pilot Devices

• Power Automate Desktop All Devices

Power Automate Desktop Canaries will include a small number of closely-watched machines

(such as your test machine and maybe another IT member’s machine).

The Power Automate Desktop Pilot Devices group will contain a small number of users who

have agreed to be testers on new deployments. They should typically be power users who are

good at giving feedback if something isn’t working.

Power Automate Desktop All Devices will contain all devices onto which Power Automate

Desktop will be deployed.


Each ring is a Device Collection.

Deploy the production version first to Power Automate Desktop Canaries. Once all machines

have been tested, continue to deploy then to Pilot Devices. Once all those installs have been

confirmed and testing has taken place, you can finally deploy to All Devices.

In this way you can keep your users up to date on an on-going basis, all from within the

Configuration Manager Console.


Intune deployment

Requirements • Microsoft Win32 Content Prep Tool (https://github.com/microsoft/Microsoft-Win32-

Content-Prep-Tool/releases)

• Windows 10 Pro, Business, Enterprise, or Education version 1709 or newer

o Must be enrolled in Intune

Create Azure security group 1. Browse to https://portal.azure.com and sign in with your Admin account.

2. In the Search resources, services, and docs search bar, enter Azure Active

Directory

3. Select the Azure Active Directory blade.

4. Click Groups in the left pane.

5. Click + (plus sign) for New group at the top of the middle pane.

6.

https://github.com/microsoft/Microsoft-Win32-Content-Prep-Tool/releases

https://github.com/microsoft/Microsoft-Win32-Content-Prep-Tool/releases


7. Create a new security group called Install Power Automate Canaries (or

something similar to let you know this is for your first ring deployment).

8. Add any Members to the group you will use to test the installation of Power Automate

Desktop.

9. Click Create.

Install application on a test machine This step is required to get the detection method settings for building the package.

1. Install Power Automate Desktop on a test machine and find the msi product code in the

registry at this location:


SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\

2. Copy the path and the DisplayVersion and paste them into a Notepad file. You will need

them when building the package in the next step.

Create content prep tool directories Note: These three directories can exist anywhere on your local machine, but we recommend

keeping them in the root of your C: drive, so that there is less chance of typos when navigating

the paths through command line. You may choose to put them all under a single directory or on

another drive. The folder names are also optional, and you may call them whatever you wish.

1. Create a Packager folder in C:\Packager

This is where you will extract the Microsoft Win32 Content Prep Tool that you

downloaded from GitHub in the Requirements. You should have an executable called

IntuneWinAppUtil.exe.

2. Create a Packages folder in C:\Packages

This is a destination where you will put the packaged applications after they have been

packaged by the Content Prep Tool.

3. Create a Sources folder in C:\Sources

This is where you will store your application installers / scripts prior to packaging them

with the Content Prep Tool.

4. Create a subfolder in C:\Sources\PowerAutomateDesktop

Store your installer file in this subfolder.


Build application package 1. Open Command Prompt and change directory to your packager folder.

2. Run IntuneWinAppUtil.exe.


3. Specify the source folder.

4. Specify your setup filename.


5. Specify the packages location you created earlier.

6. Type “n” for no and finish your setup.


7. Make sure your window says “Done!!! 100%”

8. Close Command Prompt.

Deploy application 1. Browse to https://endpoint.microsoft.com and sign in with your admin credentials.

https://endpoint.microsoft.com/


2. Browse to Apps > All Apps.

3. Click + Add.


4. In the Select app type window on the right side of your browser, select the Windows

app (Win32 ) in the App type drop-down. Then click Select.


5. In App package file browse to your C:\Packages location, select

Setup.Microsoft.PowerAutomateDesktop.intunewin, and click OK.

6. Specify the Name, Description, and Publisher.


7. Add the version number to the name to help distinguish between updates later on.

8. Then click Next.

9. On the Program tab:

a. Paste the following into the install command line:

Setup.Microsoft.PowerAutomateDesktop.exe -Silent -Install -

ACCEPTEULA

b. Paste the following into the uninstall command line:

Setup.Microsoft.PowerAutomateDesktop.exe -Silent -Uninstall


10. Click Next.

11. On the Requirements tab:

a. Change the Operating system architecture to 64bit.

b. Change the Minimum operating system to Windows 10 1709.

c. Change the Disk space required (MB) to 300.


12. Click Next.

13. On the Detection Rules tab:

a. In Rules format, select Manually configure detection rules

b. Click + Add.

c. For Rule type, select Registry.

d. Paste the following into the key path:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\C

urrentVersion\Uninstall\{4878e8ce-ef33-4cdb-86ee-

b402d3147439}

e. For Value name, enter DisplayVersion.

f. For Detection method, select String comparison.

g. For Operator, select Equals.

h. For Value, enter the version number of Power Automate Desktop.

i. Click OK.


14. Click Next.

15. On the Dependencies tab, click Next.

16. On the Sepersedence tab, click Next.

17. On the Assignments tab:

a. Under Required click + Add Group.

b. Find the group you created earlier, called Install Power Automate Canaries.

18. Click Next.

19. On the Review tab, verify that everything looks good.

20. Click Create.

Silent registration for machines You can automate registration of this machine with Power Automate Service. This allows the

user to trigger desktop flows from various triggers (schedule, event based etc.) and admins to


monitor/ manage/ govern thesedeployments. Read this article Silent registration for machines

and watch this video on how to register machines with Power Automate.

https://docs.microsoft.com/en-us/power-automate/desktop-flows/machines-silent-registration

https://www.youtube.com/watch?v=5cDOJX--Vcw&list=PLi9EhCY4z99XhBAdxiQL2QyOzhVgHxtAP&index=6&t=1s


Intune lifecycle management

Update to the latest version 1. Follow all steps in Intune deployment to build the application package with the latest

version. Your Endpoint Manager Action Center should then have a new application package

with the newest version, as shown below.

2. Click on the new app in Intune and go to Properties.


3. Scroll down to Supersedence and click Edit.

4. Add the previous version of Power Automate Desktop.

5. Set the Uninstall to No.


6. Click Review + save.

7. Deploy your updated application to your Install Power Automate Canaries group before

continuing with your other rings. See the section below to learn more about ring

deployment.

Note: After all users have been upgraded to the latest version, you may remove the old app

from Intune.

Ring deployment Ring deployment is a methodology where you first deploy newer versions to select test, pilot,

and production groups. Basically, you deploy to a small number of endpoints, then a larger

number, and continuing for as many rings as make sense for your environment until you have


deployed to all users, as shown in the diagram:

We recommend deploying apps through Intune by targeting users instead of devices. Follow the

steps to create a few Azure Security Groups and add member user accounts instead of their

devices.

To fully manage the lifecycle in Intune for this demonstration you will create three deployment

rings:

• Install Power Automate Canaries

• Install Power Automate Pilot

• Install Power Automate All Users

Power Automate Desktop Canaries will include a small number of closely-watched machines

(such as your test machine and maybe another IT member’s machine).

The Power Automate Desktop Pilot Devices group will contain a small number of users who

have agreed to be testers on new deployments. They should typically be power users who are

good at giving feedback if something isn’t working.

Power Automate Desktop All Devices will contain all devices onto which Power Automate

Desktop will be deployed.


Each ring should have an Azure Security Group.

In Apps > All Apps > Microsoft Power Automate > Assignments, first add the Install Power

Automate Canaries security group, wait for all users to install and verify there are no

complications, then add Install Power Automate Pilot security group, and finally add Install

Power Automate All Users.


This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein.

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless

otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and

events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address,

logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of

the user.

Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval

system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any

purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter

in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document

does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

The names of manufacturers, products, or URLs are provided for informational purposes only and Microsoft makes no

representations or warranties, either expressed, implied, or statutory, regarding these manufacturers or the use of the products with

any Microsoft technologies. The inclusion of a manufacturer or product does not imply endorsement of Microsoft of the

manufacturer or product.

Links may be provided to third party sites. Such sites are not under the control of Microsoft and Microsoft is not responsible for the

contents of any linked site or any link contained in a linked site, or any changes or updates to such sites. Microsoft is not responsible

for webcasting, or any other form of transmission received from any linked site. Microsoft is providing these links to you only as a

convenience, and the inclusion of any link does not imply endorsement of Microsoft of the site, or the products contained therein.

© 2021 Microsoft Corporation. All rights reserved.

Microsoft and the trademarks listed at https://www.microsoft.com/enus/legal/intellectualproperty/Trademarks/Usage/General.aspx

are trademarks of the Microsoft group of companies.

https://www.microsoft.com/enus/legal/intellectualproperty/Trademarks/Usage/General.aspx

managing power automate desktop on windows

Documents