Rest API call - Send HTTP Request to SharePoint (ensureuser)

(2) Share

Report

Posted on by mvn

I'm using Send HTTP Request action to add site collection admin using Rest APIs. First I'm calling ensureuser and then adding SCA in another Send HTTP Request action. The connection is made using the account creating the flow, which is Sharepoint admin in the tenant. However I get error in Ensureuser action:

"status": 403,
"message": "Attempted to perform an unauthorized operation.
"errors": [
            "-",
            "System.UnauthorizedAccessException"
 
 
not sure why this fails as user is SPO tenant admin and connection uses this account. Plan is to get the output id of Ensureuser and add users as site collection admin in next step.
 

Categories:

Building flows

I have the same question (0)

All responses (8)

Answers (0)

Suggested answer

MS.Ragavendar 4,984 Super User 2025 Season 2 on at

Like (0)

Report

@mvn,

I replicated the scenario from my side and i couldn't experience any issue from my side.

Flow Output

can you please update the logon in the format as shown.

Please click Accept as solution if my post helped you solve your issue. This will help others find it more readily. It also closes the item

Was this reply helpful? Yes No
mvn 32 on at

Like (0)

Report

I tried using full upn as well but results are same.

Was this reply helpful? Yes No
Suggested answer

w.p 8,339 Super User 2025 Season 2 on at

Like (0)

Report

Ensure you add your flow account to the SCA.

Was this reply helpful? Yes No
mvn 32 on at

Like (0)

Report

The reason I'm building this flow is to remove support accounts including the account running flow from SCA of sites as some end users have concerns when they see these account names while they check access for documents. I realise admin can add them back anytime but atleast these gets logged.

So we though of building a flow to remove all our admin accounts and run this flow on a timer but I guess to get this to work flow account should be SCA.

I did this fine with PNP powershell by first adding account running PS to SCA, remove all accounts needed from SCA and then removing myself at the end but we wanted to automate this using flow instead of running PS script which takes weeks to complete and is a challenge to host the script somewhere centrally to run, hence though of flow as an option.

Was this reply helpful? Yes No
w.p 8,339 Super User 2025 Season 2 on at

Like (0)

Report

Add another SCA first before removing the flow account from SCA.

Was this reply helpful? Yes No
mvn 32 on at

Like (0)

Report

thats already tried and it won't work because the Sharepoint tenant admin account running flow isn't SCA on the site hence can't add another SCA - thats the main issue.

Was this reply helpful? Yes No
Suggested answer

w.p 8,339 Super User 2025 Season 2 on at

Like (0)

Report

As far as I know, in PA, it doesn't matter if the flow account is a global or SharePoint admin.

The flow account needs to be in the SCA first before it can add or remove users from SCA.

"message": "Attempted to perform an unauthorized operation.

The error message indicates the flow account lacks site access or the necessary permissions.

Was this reply helpful? Yes No
MS.Ragavendar 4,984 Super User 2025 Season 2 on at

Like (0)

Report

@mvn,

Either My suggestion or @w.p would have helped in resolving the issue - please verified answer accordingly.

Or do you still encountering any challenges on this implementation kindly revert accordingly.

Was this reply helpful? Yes No