Access Token Error with HTTP Action to Graph Explorer

[clemay]

Hello, 

I was hoping that I might be able to get some help with an error I am getting with an HTTP action in my Flow. Currently I have what was at one time a very simple and reliable flow to get the staff members from a location in Microsoft Bookings. I am using the HTTP action to do a GET call out to Graph Explorer to retrieve all staff members for the location that was selected previously in the flow trigger. 

In the HTTP action I pass the ID for the Bookings location as the output of a compose action and then I pass my Access Token as a string variable. To get the Access Token for my own account, I just grab it from the Graph Explorer site on the "Access Token" tab. It expires pretty frequently, but this flow is only for testing and this always worked in the past. 

I was able to pass the access token through to Graph using "RAW" authentication method and putting the access token variable in the "Value" field OR the "None" authentication method and passing the token in the header (Authorization / Bearer {Token}). 

However, for the last week or so I now run into the following error in any workflow that uses this HTTP action with these settings. 

I have tried to check through the conditional access logs, but I don't see any corresponding failures. The "Request ID" listed in the error also does not correspond with anything in the logs. I checked with our Team that runs the conditional access policies and per them nothing has changed related to continuous access evaluation? 

Anyone have any ideas what may be occurring OR if I can structure my flow differently to work around this error? I can use the Graph Explorer directly with no issues. It is just trying to use graph explorer via an HTTP action that runs into the issues. 

Thanks,

Chris

[abm]

Hi @clemay 

Check this connector. See below Send an HTTP request. There are two available. Other one is in preview. If you use this connector you don't need specific authentication. Default it will use your office authentication connection.

Try using the GRAPH API using this connector.

[clemay]

Hi! Let me give that a try. Quick question. How would I format the body of the HTTP request to include the access token? I am assuming that is where I would need to include that info? 

[abm]

Hi @clemay 

The good news is you don't need the HTTP token for this connector. Believe the connection you used for this action step (user) has enough privileges. 

Thanks

[clemay]

Alright I gave that a go and I unfortunately I ran into this error message. 

The Graph Request URI is valid if entered directly in the Graph Explorer. 

I am assuming that error message means that only the "me,users,groups,sites,search,planner,teams,chats" resources are support with the M365 Groups HTTP connector? So BookingsBusiness is not a valid resource here? 

[abm]

Hi @clemay 

ok thanks for letting me know about this. Looks like your original error is related to auth token. Did you tried registering the app registration under Azure and set up a Client Id and Secret key?

Thanks

[clemay]

Yes Sir. We have an App Registration spun up; however, we are running into a separate issue with that. Maybe you can help me find the correct Microsoft Forum to direct that question. 

Basically, we are trying to do similar PowerAutomate workflows where we use HTTP actions to do calls to Microsoft Graph to perform admin actions in Microsoft Bookings. We have a "Bookings" App - Registration that we have granted every Bookings related Graph API permissions that we could find. The app registration is able to carry out HTTP actions that do "GET" calls just fine.

Example:

This HTTP action will work.

However, it gets an "Access Denied" message when trying to do something like POST

Example: 

This HTTP action will fail

App Registration Permissions:

I know this forum is specifically PowerAutomate related and while this issue is occurring in PowerAutomate for us, it is probably related to the App Registration Permissions? 

Also thank you for all the help so far! I was talking with our Azure Admins, and they are thinking that the original issue related to the user account access tokens, may be related to the M365 Downtime Last week. As the issue started right at the same time as the downtime related to conditional access policies around Geo Location. Will post here if we figure out what is happening. 

[abm]

Hi @clemay 

Also its worth looking that delegated permission Admin consent to 'Yes'.

Thanks