When using the trigger action When a HTTP request is received in Power Automate there are three possible options for who can trigger the flow:
- Any user in my tenant.
- Specific users in my tenant.
- Anyone.
When using the anyone option, the flow can be executed by anyone that happens to know the flow URL. It would be nice if there was an option to restrict the anyone option to trusted IP addresses, this functionality is not included by default, but it is easy to add it with a trigger condition.
The expression:
triggerOutputs().headers['CLIENT-IP']
Provides access to the IP address of the calling client and the port it used to make the request, for example:
82.68.224.86:58749
So it is almost exactly what we need to add a trigger action to restrict the HTTP trigger to a single IP, or a group of trusted IP addresses. Using this expression, we can capture only the IP address:
first(split(triggerOutputs()['headers']?['CLIENT-IP'], ':'))
So a trigger condition to restrict the flow to a single IP address would look like this:
@equals(first(split(triggerOutputs()['headers']?['CLIENT-IP'], ':')), '82.68.224.86')
To filter it to a list of trusted IP addresses you can use this expression:
@contains(
json('[ "82.68.224.86", "82.68.224.87" ]'),
first(split(triggerOutputs()['headers']?['CLIENT-IP'], ':'))
)
In the above example, both 82.68.224.86 and 82.68.224.87 would be able to execute the HTTP flow.
Other interesting outputs:
- User-Agent (e.g. Mozilla/5.0,(Windows NT 10.0; Win64; x64)
- sec-ch-ua-platform (e.g. Windows)
To create a trigger condition, click on the settings of the HTTP trigger:
and then add the trigger condition at the bottom of the settings:
Don’t forget you that trigger conditions require an @ symbol at the start of the expression.
By using this trigger condition, the flow will not execute at all when it is requested from an IP address that is not in the list of trusted IP’s.