Unanswered

Urgent - How do tokens work in power automate? - 'Failed to refresh access token for service

Like (0) Share

Report

Posted on 27 Nov 2024 17:34:48 by WA-07111705-0

Hi all,

We have been using the power platform for over 4 years now, but within this year everything to do with power automate has been unstable to the point where we are considering migration from power automate overall.

Our organization started to require 2FA external verification for our powerapps and I do not know if it is related.

I have a powerapp that utilizes power automate flows and it is almost as reliable as a coin flip now, whereas a year ago it was completely reliable.

For my sharepoint connectors (get items specifically) and outlook connectors (Send an Email V2 specifically) are almost unusable anymore.

The error message is "Error from token exchange: Runtime call was blocked because connection has error status: Enabled| Error, and office365 is in the block list. Connection errors: [ParameterName: token, Error: Code: Unauthorized, Message: 'Failed to refresh access token for service: aadcertificate. ]"

I have done the following:

1: Delete the automate connections and remake them for sharepoint and outlook
2: Remake the entire flow from scratch with new connections

I do not understand why this is happening.

This is a powerapp with a few thousand users that have peak periods, with long periods of dormancy between some users.

What I don't understand is why does this happen randomly? I had a user came to me with an error and I looked at the logs in powerautomate and determined it was this specific error. I delete the user's sharepoint record (so they could try again), and it worked.

Why does this error only happen to some users some of the time? I've witnessed users click a button, the flow fails with the expired access token, it works again, and then it fails again.

How can I make my automate flows using sharepoint get items and send an email V2 outlook connector be reliable again?

Is there a way I can verify a token in a power automate or powerapp when the first interactions with it?

I have asked my colleagues and we have not identified a solution or found any problems in AD. I have asked Microsoft reps who were unable to help me.

Categories:

Business Process Flows

All responses (2)

Answers (0)

WBADAM03 177 on 02 Jan 2025 at 14:46:25

Like (0)

Report

Urgent - How do tokens work in power automate? - 'Failed to refresh access token for service

@Andy_Moyer

Sorry Let me explain a bit more. The problem is that tokens expire 90 days after it has been granted. When a user first signs into the powerapp, it asks the user to make/approve connections to the services used in the powerapp/flow (such as outlook, sharepoint, etc).

What I meant by frequency is that we have hundreds of end users who will use the app for a few days, go away for a while, and come back. For most users, it's perhaps an annual thing, for others it may be every 6 months or so. As a result, a lot of users use the app, then have at least 90 days of inactivity, so the tokens expire.

The problem I have is that the powerapp does not ask users to remake connections/warn them a connection is broken/grant new tokens. I don't know what happens under the hood, and neither do the Microsoft reps who I've been frustratingly working with over a month now on this problem with no resolution.

This is a bug that Microsoft is aware of now: https://admin.powerplatform.microsoft.com/knownissues/4455860 .

What I don't understand is that the issue is "Resolved" but the text indicates that they haven't fixed it and instead have two workarounds.

I have spent 3 weeks alone trying to explain to a Microsoft rep that these workarounds do not actually solve the problem because asking 300 or so end users to do these steps to make something as simple as "click a button and send an email" is ridiculous. The MS rep I have been assigned to is incapable of doing anything but telling me to ask an end user to do workarounds. He goes back and forth between "a patch is being deployed/was deployed" and "the problem is fixed; you have to do these workarounds (not a fix)".

This is after being bounced around 3 departments that had nothing to do with powerapps before talking to this rep as well.

You can view the patch notes for the powerapps releases here: Released Versions Power Apps - Release Notes | Microsoft Learn But the newest patch note was completely empty and now gives me a 404. Most versions released in 2024 from July 2024 onwards have 0 notes, so who knows what was updated.

If you want a work around and have a premium power automate license, let me tell you what I did.

1: Copy the flow that fails
2: Turn on the copied flow (will be turned off by default)
3: turn off the powerapps trigger on the copied flow, replace it with "when an HTTP request is received" (you may need to configure the settings such as who can call the flow, just FYI)
4: On the original flow, add a step of send an HTTP request, point the URI to the trigger of the "when an HTTP request is received" on the copied flow and have it configured to run on "error" from the failing step. Make sure that it is configured to run after an error or the code won't execute

If you configured this correctly, what will happen is that the end user goes to the powerapp, triggers the flow with their behavior, then the flow will run. The flow will see that a token is expired for a service like "get items" or "send an email" (outlook/sharepoint tokens) and then the "on-error" code will execute, which will send an HTTP request to the copied flow. The copied flow, since it's trigger is a flow, will use the owner's tokens instead of the end user's tokens. This means that if the owner has valid tokens (which seems to always be the case in my environment), it will exectue correctly with the same input as intended.

A few caveats to my solution

1: You need a premium powerautomate license to use the http connectors
2: You may need to change the settings on the API call and that may cause a security concern
3: If the flow calls the child flow (the copied flow), it will use the powerautomate owner/creator account to do the steps. So be sure that it's appropriate that the flow owner interacts with the flow logic.
4: This doubles the amount of flows you have, increased processing time, and increases traffic slightly.

One thing I have looked into but haven't made much progress is if there is a way to send an HTTP request to the MS graph API to grant new tokens for the specified user's service. I did something similar once, but it was a bit confusing, and I am not sure if I want to have to do this step before every single flow we have.
Andy_Moyer 28 on 02 Jan 2025 at 14:18:11

Like (0)

Report

Urgent - How do tokens work in power automate? - 'Failed to refresh access token for service

Any luck in finding an answer to this issue through your research?

Been investigating similar problems, not as frequent as yours, more on a 90 day cycle.

Thanks,

Andy

Community site session details

Urgent - How do tokens work in power automate? - 'Failed to refresh access token for service

Helpful resources

News and Announcements

Quick Links

Understanding Microsoft Agents - Introductory Session

Warren Belz – Community Spotlight

Congratulations to the April Top 10 Community Stars!

Leaderboard > Power Automate - Building Flows

Featured topics

Product updates

Community site session details

Urgent - How do tokens work in power automate? - 'Failed to refresh access token for service

Helpful resources

News and Announcements

Quick Links

Understanding Microsoft Agents - Introductory Session

Warren Belz – Community Spotlight

Congratulations to the April Top 10 Community Stars!

Subscribe to this forum!

Select categories

Leaderboard > Power Automate - Building Flows

Featured topics

Product updates