A cloud flow in production updates opportunity rows through a Dataverse connection reference that uses service principal authentication. An auditor reviewing the rows asks whose name appears in the Modified By column after the flow writes to them. What will the Modified By column show?
Select an answer to reveal the explanation.
Short Explanation
Dataverse stamps the row with whoever actually made the call, and here that's the application user tied to your service principal. It's not the flow owner and not some generic system account. That's exactly why service principals make audit trails clean.
Full Explanation
When a Dataverse connection uses service principal authentication, each request is authenticated as the app registration, and Dataverse maps it to the corresponding application user in the environment. That application user becomes the calling user for the operation, so system columns such as Modified By and Created By, along with audit history, record the application user's name. This gives auditors a clear, stable identity for automated changes, distinct from human edits. The flow owner does not appear, because flows execute actions with the identity of the connection that each action uses, not with the identity of the person who owns the flow; if the connection used a personal account, that account would appear instead. The Dataverse connector does not impersonate whoever last opened the row; impersonation requires an explicit caller ID with the delegate privilege, which the connection does not apply. SYSTEM is an internal identity used for certain platform operations, such as some system jobs, and is not substituted for application users making API calls. Exam caveat: some connector actions offer impersonation through a Run as setting in specific scenarios, which would change the recorded user, so check the flow's configuration when the result is surprising. Operational check: run the flow against a test row and confirm its Modified By value and audit entry show the application user's name.