Answered

Azure AD "Get Group" error "resource does not exist" when in a Flow with trigger "HTTP Request"

(0) Share

Report

Posted on by LozzieD

203

I have a Flow with the "HTTP Request" trigger. In the Flow the Azure AD "Get Group" action, which is supplied with a valid group GUID, errors with "resource <GUID> does not exist".

The group GUID is valid because when I put the same Azure AD "Get Group" action in a Flow that has the manual button trigger it works fine and returns the group.

Does a Flow that starts with a "HTTP Request" run in a different context from the "normal" situation of "a Flow runs in the context of the user who triggered it"?

Hence the manual button triggered Flow runs in my security context (if I run it) which has permissions to get the group specified by the GUID.

But the "HTTP Request" triggered Flow runs in the context of some other account which doesn't have access to the group, hence "resource <GUID> does not exist"? Maybe?

If so, how do I pass the context I want the "HTTP Request" triggered Flow to run in to be able to use the actions like Azure AD "Get Group"?

Categories:

Building flows

I have the same question (0)

All responses (5)

Answers (1)

Sort by

LozzieD 203 on at

Like (0)

Report
Copy link

Link copied!

Some more info ...
When there's a SharePoint "Create Item" action in the "HTTP Request" triggered Flow the "created by" column is populated with the user who ran the Flow that called (with the "HTTP" action) the "HTTP Request" triggered Flow.
So the context of the "HTTP Request" triggered Flow appears to be delegated to from the calling Flow. In this case the user - me - is valid for doing a "Get Group" action as proven when the "Get Group" action is in a "manual button" triggered Flow.

Was this reply helpful? Yes No
v-yamao-msft Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Hi @LozzieD,

Could you share a screenshot of your flow?

How do you specify the GUID of the group when using the HTTP trigger?

If you get it from the HTTP trigger, please make sure it does return a valid GUID that can be validated by flow.

Please check it on your side.

Best regards,

Mabel

Was this reply helpful? Yes No
LozzieD 203 on at

Like (0)

Report
Copy link

Link copied!

Hi Mabel,

Here's the HTTP Request Flow stripped to the bone ...

Here's the Flow that calls it with an HTTP action, again stripped to the bone ...

The group ID is gained from Azure AD here ...

The Flows fails as follows ...

Now here's a clue. I've implemented the exact same Flow and Flow caller pair in another tenant and it works ok.

The tenant it works in ok is monthly updates, and the tenant it doesn't work in is bi-annual updates - I think.

Let me look into that and see what other differences there might be. But perhaps you could try it too and see what you get?

Was this reply helpful? Yes No
LozzieD 203 on at

Like (0)

Report
Copy link

Link copied!

And for completeness, here's the HTTP request triggered Flow when it works in the other tenancy ...
So to be clear: The group GUID is simply being copy pasted from the Azure AD portal into the HTTP caller Flow in both the tenant that works, and the tenant that doesn't work.

Was this reply helpful? Yes No
Verified answer

LozzieD 203 on at

Like (0)

Report
Copy link

Link copied!

Ok, my bad.
Somehow, the "Get Group" action in the "HTTP Request" triggered Flow was running the connector in the context of a dfferent user account from another tenancy / domain than the logged on account I was using to craft the Flow. This other account was one I had been using in other windows of the browser and seemed to have been selected for the account to use on the connector of the "Get Group" action.
When I replaced the account used on the connection for the "Get Group" action with the correct account in this tenancy / domain the "HTTP Request" triggered Flow worked fine when called from the "HTTP" Flow.
Apologies for the distraction!

Was this reply helpful? Yes No