/setup

name: setup
description: Set up Power Automate CLI prerequisites. Use when the user is new, something isn't working, or they need help getting started.
user-invocable: true
allowed-tools: Bash, Read, Write, Glob, Grep, AskUserQuestion, mcp__flowagent__list_environments, mcp__flowagent__set_current_env, mcp__flowagent__get_current_env, mcp__flowagent__resolve_environment, mcp__flowagent__list_flows, mcp__flowagent__get_flow, mcp__flowagent__create_flow, mcp__flowagent__update_flow, mcp__flowagent__edit_flow, mcp__flowagent__copy_flow, mcp__flowagent__publish_flow, mcp__flowagent__disable_flow, mcp__flowagent__delete_flow, mcp__flowagent__run_flow, mcp__flowagent__get_run_history, mcp__flowagent__get_run_details, mcp__flowagent__get_run_actions, mcp__flowagent__get_run_action_repetitions, mcp__flowagent__cancel_run, mcp__flowagent__cancel_all_runs, mcp__flowagent__resubmit_run, mcp__flowagent__diagnose_run, mcp__flowagent__list_connections, mcp__flowagent__list_connectors, mcp__flowagent__get_connector, mcp__flowagent__search_operations, mcp__flowagent__get_operation_details, mcp__flowagent__pick_or_create_connection, mcp__flowagent__resolve_refs, mcp__flowagent__resolve_params, mcp__flowagent__scaffold_flow, mcp__flowagent__list_templates, mcp__flowagent__validate_flow, mcp__flowagent__preflight_flow, mcp__flowagent__smoke_test, mcp__flowagent__get_expression_help, mcp__flowagent__list_desktop_flows, mcp__flowagent__list_machine_groups, mcp__flowagent__run_desktop_flow, mcp__flowagent__get_flow_context, mcp__flowagent__set_current_flow, mcp__flowagent__clear_current_flow, mcp__flowagent__invoke_operation, mcp__flowagent__get_past_trigger_inputs, mcp__flowagent__test_connection, mcp__flowagent__fix_connection, mcp__flowagent__delete_connection, mcp__flowagent__preview_update, mcp__flowagent__get_backup, mcp__flowagent__list_backups, mcp__flowagent__restore_backup, mcp__flowagent__list_trigger_emulators, mcp__flowagent__whoami, mcp__flowagent__doctor, mcp__flowagent__reconnect, mcp__flowagent__list_accounts, mcp__flowagent__switch_account
model: opus

First-Time Setup Guide

You are helping a non-technical user get the Power Automate plugin working for the first time. Be friendly, use plain language, and never assume they know terminal commands. Walk them through each step one at a time.

Step 1: Check Node.js

Run silently:

node --version 2>&1

• **If it works** (prints something like `v18.x.x` or higher): Tell them "Node.js is installed" and move on.
• **If it fails or version is below 18**: Tell them they need Node.js 18 or newer. Ask what operating system they're on, then give them the simplest install instructions:
• **Windows**: "Go to https://nodejs.org, download the LTS version, and run the installer. Click Next through everything."
• **Mac**: "Open Terminal and run: `brew install node`" (or direct them to nodejs.org)
• After they've installed it, re-check with `node --version`.

Step 2: Check Azure CLI

Run silently:

az --version 2>&1

• **If it works**: Tell them "Azure CLI is installed" and move on.
• **If it fails**: Tell them they need the Azure CLI. Ask their OS:
• **Windows**: "Open PowerShell as administrator and run: `winget install Microsoft.AzureCLI`" or direct them to https://aka.ms/installazurecliwindows
• **Mac**: "`brew install azure-cli`"
• After install, re-check with `az --version`.

Step 3: Azure Login

Check if they're already logged in:

az account show --output json 2>&1

• **If it works** (shows account info): Tell them who they're logged in as (show the `user.name` field) and ask if that's the right account.
• **If it fails**: Tell them "Let's sign you into Azure." Then run:

  az login

This will open their browser. Tell them: "A browser window should open. Sign in with your work account — the one you use for Power Automate." After login completes, confirm it worked by running `az account show` again.

**Verify token access** — this catches permission issues early.

First find out which Azure cloud they're on, because the Power Automate resource URL differs per cloud and the commercial one cannot be assumed (GCC High / DoD tenants will fail against it):

az cloud show --query name -o tsv

| `az cloud show` | Power Automate resource | |---|---| | `AzureCloud` (commercial) | `https://service.flow.microsoft.com` | | `AzureCloud` + GCC tenant | `https://gov.service.flow.microsoft.us` | | `AzureUSGovernment` (GCC High) | `https://high.service.flow.microsoft.us` | | `AzureUSGovernment` (DoD) | Operator-verified `PA_FLOW_RESOURCE` value required; no built-in audience |

`az cloud show` cannot distinguish commercial from GCC, or GCC High from DoD — for those, set `PA_CLOUD=gcc` / `PA_CLOUD=dod` explicitly.

DoD endpoint hosts use `appsplatform.us`, but that does not establish the token audience (App ID URI). With `PA_CLOUD=dod`, FlowAgent requires an explicit, operator-verified `PA_FLOW_RESOURCE` and fails configuration otherwise. Do not copy a guessed audience from a hostname; obtain the correct value for the tenant.

Then request a token for the matching resource, e.g. for commercial:

az account get-access-token --resource https://service.flow.microsoft.com --output json 2>&1

FlowAgent itself auto-detects the cloud the same way; you can override the detection with `PA_CLOUD=commercial|gcc|gcchigh|dod`.

• **If it works**: Move on.
• **If it fails with "AADSTS65002"** (common in GCC High): the Azure CLI app isn't

preauthorized for the Power Automate resource in that cloud. This is not a license problem. Register a public-client app with delegated Power Automate (Flow service) permissions and set `PA_CLIENT_ID=<app-id>`; flow commands then use that app.

• **If it fails with any other "AADSTS"**: The user's account may not have Power Automate access. Tell them: "Your Azure account doesn't seem to have access to Power Automate. Check with your IT admin that