Power Automate

Run-only user has permissions error

(0) Share

Report

Posted on by leo85

617

Hi,

I'm having an issue with run-only permissions of a flow.

Architecture

I have a canvas app, which acts as an input form for the application. The app has a button, which triggers a power automate flow. The flow is associated with the canvas app. The flow is a premium flow, which uses Dataverse. The flow is shared with a group "Users" as Run-Only users. It uses the connection of the owner of the flow. The canvas app is also shared with the "User" group. The users in the "User" group do not have any Power Platform licenses (premium or power apps/automate for O365). But pay-as-you-go licensing is activated for the environment and the canvas app. The environment is a production environment. A team exists for the "User" group, but it does not have any security roles assigned.

Problem:

Users can open the canvas app and enter their information. When the press the button to trigger the flow the get the following error message:

"Sendrequest.Run failed: ... code: 0x80040220 .... Principal user .... is missing prvReadWorkflow privilege on OTC=4703 for entity 'workflow' ..."

For some users the error message disappears after they refresh the application, but the flow does not trigger. For some users the app and flow work fine after 1 or 2 days.

I tested this on a different tenant with a non-premium flow, though, but users not having licenses or security roles either. There it worked fine.

Does anybody know what the issue may be?

Regards

Categories:

Using flows

I have the same question (0)

All responses (3)

Answers (0)

Suggested answer

Pstork1 69,121 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Run only user settings cover permissions for the back end data source but they have no effect on the Power Platform licensing. So your user's of the canvas app will all need premium licenses or the equivalent per app (pay as you go) license. My suspicion is that you either don't have enough pay as you go licenses or they aren't getting assigned properly. When you look at the details for the canvas app does it show as Premium? If you are using any kind of a custom connector it should.

But the bottom line is that I suspect you want the run only user setting to cover the Premium connection. It won't. It will only cover the data source permissions, not the licensing.

----------------------------------------------------------------------------------
If this Post helped you, please click "Does this answer your question" and give it a like to help others in the community find the answer too!

Paul Papanek Stork, MVP
Blog: https://www.dontpapanic.com/blog

Was this reply helpful? Yes No
leo85 617 on at

Like (0)

Report
Copy link

Link copied!

Hi @Pstork1,

no, I don't want the run-only setting to cover the premium connection. I'm aware that it does not. That's why we've got PAYG licenses assigend to the environment.

The canvas app shows up as "premium". How can I not have enough PAYG licenses? Is there some kind of limit that can be set? We only had a hand full of users test it, so this should not be an issue.

Maybe the licenses are not correctly assigned. The users who have issues do not show up in the PAYG licenses summary under PAYG. But then again, the summary seems to be lagging a day behind usage. In the app settings the PAYG toggle is activated, but there is an warning "The App Passes meter is disabled. It is required to launch Power Apps. Edit the policy to enable it.".

Was this reply helpful? Yes No
clbamford 11 on at

Like (0)

Report
Copy link

Link copied!

Hi @leo85,

Did you ever find a solution? I'm running into this issue now with the exact same setup - PAYG configured for a canvas app, etc.

Was this reply helpful? Yes No