Attended vs unattended desktop flow runs

What it does

The run mode set on the Run a flow built with Power Automate for desktop action decides whether the automation shares a signed-in user's Windows session or gets its own. Attended runs happen in front of a logged-in user. Unattended runs open their own session, do the work behind a locked screen, and sign out afterwards.

Key facts

Attended RPA is covered by the Power Automate Premium user licence. Unattended runs need the Power Automate Process plan (previously "per flow"). The licence that matters belongs to the creator of the desktop flow connection, not whoever clicks Run.
For unattended runs Power Automate creates a remote desktop (RDP) session using the credentials on the connection, runs the flow, then releases the session. Connecting to the machine's console session isn't an option for unattended.
The connection user must be able to open an RDP session — in practice, membership of Remote Desktop Users (or Direct Access Users on some Citrix builds).
Windows 10 and Windows 11 can't run unattended flows if any Windows user session exists, even a locked one. On Windows Server, a locked session belonging to the same user as the connection produces an error.
Unattended flows can't run with elevated privileges, and audio, camera and video-capture peripherals aren't supported in unattended sessions.
Reuse sessions for unattended runs is a machine or machine-group setting that lets a session persist and be reused between runs rather than being torn down each time. It isn't supported on machines that permit a user to hold multiple sessions.
Video logs for unattended runs entered public preview on 30 April 2026: with Power Automate for desktop 2.66 or later and the advanced Video logs parameter switched on, the last 60 seconds before a failure are recorded locally, with optional captions mapped to actions.

When to use / skip

Attended is for anything that genuinely needs a human in the loop or that runs on a person's own desktop with their credentials — approvals, exception handling, a user kicking off a task from a button. Unattended is for volume and out-of-hours work, and it's the only mode that scales, but it costs Process licences and it needs a machine nobody logs into. If the client wants unattended on the finance team's laptops, that conversation ends badly; budget for dedicated VMs.

Configuration decisions

Run mode per action, since a single cloud flow can call attended and unattended flows in different branches.
Which account owns the desktop flow connection, because that account's licence and RDP rights determine whether anything runs at all.
Whether session reuse is on, trading faster start-up against a session that carries state between runs.
Screen resolution for the unattended session, set explicitly rather than inherited, so selectors captured during authoring still resolve.
Whether video logs are enabled for unattended runs, and where the recordings land given they're stored on the machine.

Gotchas

Someone leaves a locked session open on the target machine and every unattended run that night fails. This is the classic support ticket. Windows Server with RDS and multiple sessions is the fix, not Windows 11.
Signing in to a machine while an unattended flow is running isn't supported and tends to break the run.
Unattended sessions default to a different screen resolution from the authoring machine, which silently changes what's visible and can make a flow click the wrong element rather than fail cleanly.
The connection stores credentials for a Windows account. Password rotation policies break connections, and nothing tells you until a run fails.

Consultant notes

Price the Process licences at design time. Discovering the unattended licence requirement during UAT is a genuinely painful conversation.
Push for a service account with a managed, non-expiring credential in Key Vault, and get the security team's agreement in writing early.
Design flows to be mode-agnostic where you can — no message boxes, no dependence on a visible desktop — so an attended prototype can be promoted to unattended without a rewrite.
Warn the client that unattended machines must be treated as production servers: patched, monitored, and off-limits for casual RDP.

Recheck when the client changes their machine estate, or after any Power Automate licensing update