An error occurred during authentication using SharePoint data source

[Anonymous]

I received several messages from users yesterday stating that our apps were down. To investigate, I opened up the app to edit and got a dialogue asking to authorize the connection to SharePoint, with a message saying I needed to fix the connection. When I tried to log in to authorize, I received the error "An error occurred during authentication."

It looks like several other users were getting this error a little over a year ago in these threads: 

https://powerusers.microsoft.com/t5/Building-Power-Apps/quot-An-error-occurred-during-authentication...

https://powerusers.microsoft.com/t5/Building-Power-Apps/Sign-in-Issues-Sharepoint-list-form-doesn-t-...

https://powerusers.microsoft.com/t5/Building-Power-Apps/Problems-sharing-app/m-p/193639#M63040

My session ID is ac13889e-1e54-49a7-9870-9d3cdcbc244e

In the threads, they all mentioned that the issues were fixed, but there is no explanation of the cause of the issue or how to solve it. My users all have access to the SP lists, but unfortunately it's impossible to grant access to the root site for data access reasons.  

@EvanChakiMSFT, @linhtran , is there a fix for this? Our plant flow is critically interrupted by this error.

[EvanChakiMSFT]

@Anonymous , I will pass this to the support engineers to look at.  Can you also open a support case?

[v-xida-msft]

Hi @Anonymous ,

Could you please share more details about the error message within your app?

Have you taken a try to re-create a new connection to your SP List from your app?

Based on the issue that you mentioned, I have made a test on my side, and don't have the issue that you mentioned. Please consider remove the SP List connection from your app, then re-create a new one to your SP List from your app, then try your app again, check if the issue is solved.

If the issue still exists, please consider get the Session ID of your canvas app, then submit an assisted support ticket for further help through the following link:

https://powerapps.microsoft.com/en-us/support/pro

Best regards,

[Anonymous]

@v-xida-msft,

Thanks for your reply. I can't recreate the connection in the app because I can't open it in the editor. I don't know if I'm saying this correctly, but I think the issue might be with the permission to connect PowerApps to SharePoint, not with the specific connection to the site.

I've talked to several other divisions in the company I work for and they have confirmed that they're having the exact same issue. I believe all PowerApps are down company-wide.

[mh4Christ]

I'm one of jstark's coworkers from another plant. When attempting to connect my sharepoint list used in one of (all) powerapps with a new test canvas app results in the authentication error below:

Spoiler

Error from token exchange: Runtime call was blocked because connection has error status: Enabled| Error, and sharepointonline is in the block list. Connection errors: [ParameterName: token, Error: Code: Unauthorized, Message: 'Failed to refresh access token for service: sharepointonlinecertificatev2. Correlation Id=9d8d2bc3-d19e-4068-a515-d7eff7467649, UTC TimeStamp=1/9/2020 6:19:42 PM, Error: Failed to acquire token from AAD: {"error":"interaction_required","error_description":"AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.\r\nTrace ID: fd7c988d-de19-4a96-b807-df078e9d5100\r\nCorrelation ID: f8cb88ac-fb15-4c26-b921-6ff1ed5612ae\r\nTimestamp: 2020-01-09 18:19:42Z","error_codes":[53003],"timestamp":"2020-01-09 18:19:42Z","trace_id":"fd7c988d-de19-4a96-b807-df078e9d5100","correlation_id":"f8cb88ac-fb15-4c26-b921-6ff1ed5612ae","error_uri":"https://login.windows.net/error?code=53003","suberror":"message_only","claims":"{\"access_token\":{\..."]}}}"}']

Session ID: 40ffaa54-d205-4b0c-98ff-a46bd3d7d2f4

[EvanChakiMSFT]

The team has been looking into this.  As stated below in the error message provided, it looks like your corporate IT admin has enabled a conditional access policy - https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview.  You can contact them to see if they can disable this for Power Apps.

[Anonymous]

For those who stumble in on this thread, @EvanChakiMSFT was correct about the policy exception. Except it wasn't an exception for PowerApps, it was for Teams. I believe there was some kind of dependency for the Teams exception that affected the SharePoint connection to PowerApps. Hopefully this gives you a good starting point to go off of!