You're building a flow that watches your Power Automate environment for new or recently edited flows, checks every connector reference against Microsoft's connector tier, and posts a warning to a Teams channel the moment one of them is Premium. Nobody has to remember to check the little "Premium" tag in the maker portal. You need Environment Admin (or Power Platform admin) rights in the environment you're monitoring, and one existing flow to test the check against.
Why this approach
The obvious alternative is to trust the "Premium" label the maker portal shows you when you pick a connector. That works for the person building the flow, in the moment they're building it. It does nothing for the connector someone adds six months later during an edit, the connector a less experienced maker doesn't notice is flagged, or the forty flows already sitting in the environment before you started paying attention. A DLP policy doesn't cover this gap either. DLP data groups (Business, Non-Business, Blocked) are an admin-defined boundary about where data is allowed to flow. Connector tier (Standard, Premium) is a completely separate, Microsoft-assigned licensing property. A flow can pass every DLP rule in your tenant and still turn on a $15-a-user-a-month bill the moment someone drops in one premium connector. You need a check that runs against every flow, on a schedule, independent of who built it or when.
Step 1: Build the recurrence and decide your lookback window
New flow, trigger is Recurrence. Interval and frequency depend on how fast you want to catch changes versus how many API calls you're comfortable making - hourly is a reasonable starting point. Add a Compose action called LookbackWindow right after the trigger:
subtractFromTime(utcNow(), 1, 'Hour')Match the number to your recurrence interval. This is the timestamp you'll compare every flow's last-modified time against, so you only process what actually changed since the last run, instead of re-checking the whole environment every time.
Step 2: List the flows that changed
Add "List Flows as Admin (V2)" from the Power Automate Management connector, scoped to the environment you're monitoring. This action is fast because it deliberately returns only identifying information - name, id, and modified time - not the flow definition.
Filter the result down to what actually changed: add a Filter Array action, "From" set to the list output, condition modifiedTime is greater than the LookbackWindow value from Step 1.
Step 3: Get the full definition for each changed flow
Apply to each over the filtered array. Inside the loop, add "Get Flow as Admin", passing the current item's flow ID. This is the step that actually returns properties.connectionReferences - the object listing every connector reference the flow uses, trigger and every action, keyed by reference name.
Add a second Compose inside the loop to pull just the connector API IDs out of that object, since you'll check each one individually in the next step:
body('Get_Flow_as_Admin')?['properties']?['connectionReferences']Step 4: Check each connector's tier
Nested Apply to each over the connection references object from Step 3. For each entry, call "Get Connector" (Power Automate Management connector again), passing the connector ID from that reference's api.name value. The response includes properties.tier, which is either Standard or Premium. Append every hit where tier equals Premium to an array variable, alongside the flow's display name and the connector's display name, so the eventual warning names names instead of just saying "something's premium."
Step 5: Post the warning before it's a surprise
After both loops finish, a Condition checking whether the premium-hits array has any items. If it does, "Post message in a chat or channel" (Teams, standard connector) to whatever channel your team actually watches, naming the flow, its owner, and every premium connector it picked up. Include a direct link to the flow's edit page (https://make.powerautomate.com/environments/<environment>/flows/<flowId>/details) so whoever gets the message can open it in one click instead of hunting for it.
Common mistakes
Trying to read connector info straight off List Flows as Admin.
The V2 action is fast specifically because it doesn't return the flow definition. If your connectionReferences check comes back empty for every flow, this is almost always why - you're reading the wrong action's output. Get Flow as Admin, called per flow, is the one that actually carries connectionReferences.
Treating a passed DLP policy as proof there's no premium connector in play.
These are two different systems answering two different questions. DLP governs which connectors are allowed to talk to which data groups. Connector tier governs what you owe Microsoft. A flow with an immaculate DLP record can still be the one that gets a Per-Flow or Per-User premium license attached to it without anyone deciding that on purpose.
Only checking the trigger's connector.
The premium connector that costs you money is rarely the trigger. It's the SQL, SAP, or custom connector action buried three steps into an Apply to each that someone added to solve one edge case. Walk the entire connectionReferences object, not just what's visible on the trigger card in the designer.
Frequently Asked Questions
Do I need a premium license to build this checking flow itself?
Power Automate Management doesn't appear on Microsoft's published list of premium-tier connectors, so calling its actions typically doesn't require a premium license, just Environment Admin or Power Platform admin rights in the environment you're checking. Posting the alert through Teams uses a standard connector too, so the whole checking flow can usually run without adding a license of its own.
Does this replace my DLP policies?
No. DLP governs which connectors are allowed to move which category of data. This flow tells you which connectors are about to show up on a licensing bill. Keep both running - they're answering two different questions, not competing versions of the same one.
Will this catch a premium connector used inside a child flow?
Get Flow as Admin returns the parent flow's own connectionReferences, not what a child flow it calls uses internally. List Flows as Admin returns every flow in the environment regardless of whether it's top-level or a child, so point this same check at your child flows separately rather than assuming the parent check covers them.
What happens if a flow shows no owner?
A flow created by a service principal, or by someone whose account has since been disabled, can come back with a missing or unresolvable owner in Get Flow as Admin's output. Route that alert to an admin distribution list instead of a name field that came back empty.
Can I check more than one environment in a single run?
Not in one call. List Flows as Admin and Get Flow as Admin are both scoped to a single environment, so cover several environments by looping this whole check once per environment ID, or by duplicating the flow per environment if the list is short.
A connector shows as Premium here. Does that mean it's definitely costing us money right now?
Get Connector tells you the connector's tier, not who on your team already holds a license that covers it. Treat a Premium hit as a flag to cross-check against your tenant's actual Power Automate license assignments, not as automatic proof of a new, unbudgeted cost.
Where to go from here
Part 1 of this series covered the mental model behind triggers and connectors, if "connector" as a concept still feels fuzzy: Power Automate from Scratch, Part 1: Triggers and connectors, the mental model nobody explains. Between the Sheets closes out the series on the 27th with the finale on premium connectors and licensing traps in more depth than a five-step build has room for - this flow is the practical half of that argument.