What it does

A machine is a physical or virtual Windows device registered to a Power Platform environment so cloud flows can run desktop flows on it. A machine group bundles several machines behind one target, so runs queue against the group and get handed to whichever member is free.

Key facts

• Registration is direct connectivity: install Power Automate for desktop with the machine-runtime component, sign in, and the machine registers itself to the currently selected environment. Gateways for desktop flows are no longer supported.
• A machine can only run cloud-triggered desktop flows in one environment at a time. Changing the running environment removes all of that machine's existing connections.
• Direct connectivity isn't available on Windows 10 Home or Windows 11 Home, and you can't register machines in Teams environments.
• Registering needs the Environment Maker or Desktop Flows Machine Owner role. Three purpose-built roles ship with machine management — Machine Owner, Machine User, and Machine User Can Share — so admins can stop everyone registering their own laptop.
• Sharing is two-tier: Co-owner (run, share, edit, delete, add to group) and User (run only). Group-level access applies to every machine in the group.
• Joining a group needs a group password, generated once and unrecoverable. Windows Server 2016 can't import the AES256-protected group keys and needs a legacy-mode password, which weakens the group.
• Published limits on the machine groups page: up to 300 machines per group, 24 hours maximum run time, 12 hours maximum queued time, 500 desktop flows in the queue. The older machine-management page still quotes 50 machines per group and unlimited run time — check the current figure before you design to it.
• Machine groups aren't available in GCC, GCC High, DoD or China regions.
• Maintenance mode stops new runs being assigned to a machine or group without killing runs already in flight — the right tool for patch windows and deployments.

When to use / skip

A single machine is fine for one process with modest volume and a predictable window. Move to a group the moment you have concurrency, an SLA, or a need to survive one box being down — a group turns "the automation is broken" into "we're running a bit slower". Skip groups if all your machines are unattended and you'd rather use hosted machine groups, which handle the provisioning and scaling for you.

Configuration decisions

• Machine per process versus a shared pool, which mostly comes down to whether applications and versions conflict.
• Which account the desktop flow connections use, and whether that account can reach every machine in the group. Local Windows accounts must exist with the same password on every member.
• How many unattended bots each machine gets, since one bot carries one unattended run at a time and bots come from allocated Process capacity.
• Whether extended queue prioritisation stays on for multi-session machines, and who's allowed to move runs to the top of the queue.
• Security roles: who registers machines, who shares them, who can delete them.

Gotchas

• Never clone a VM after installing the machine runtime. The clone brings the registration with it and both machines misbehave.
• Resetting a PC loses the machine registration entirely.
• Adding a machine to a group breaks every connection currently pointing at that machine individually. Plan the cutover; don't do it on a Friday.
• Machine and group permissions can drift out of sync if someone edits privileges directly in Dataverse, and the symptoms are odd rather than obvious.
• Queue behaviour is best-effort FIFO. Runs enqueued seconds apart can start out of order, and machine selection in a large group can take up to 50 seconds — short flows in big groups look sequential.

Consultant notes

• Treat machine capacity as a sizing exercise up front: peak concurrent runs, average duration, and the window they have to finish in. Clients consistently under-buy.
• Get the group password into the client's password manager on day one. Regenerating it means re-joining every machine.
• Agree a patching and maintenance-mode routine with infrastructure before go-live, or the first Windows Update cycle takes the automation down.
• Machine groups being absent from sovereign clouds catches public-sector work out. Check the tenant's cloud before promising the design.

---

Recheck the published machine-group limits before sizing any new estate — the docs have disagreed with themselves