Dataverse Connector Error For Guest Users

[takolota]

Hello,

I built a Canvas Power App as a combination supplier portal and internal order / invoice processing tool.

Everything works well for internal users and for 80% of external supplier users that we provisioned guest accounts to.

However, one of our suppliers with about 20% of all users is facing issues where none of them can consistently access the Power App because as the app loads, it pops up with a Connections screen asking them to create a Dataverse connection. That is the only connection it asks for. When they go to create a connection, they select their account & press Create, but it just returns an error saying "We were unable to create this connection. Please try again." And the error details do not give any helpful details.

One of the users for this supplier successfully logged into the app initially. But then he clicked another link to log in again & show the other users and he got the same error shown above.
Most of these users are internationally based outside the US and they thought maybe it had something to do with some of them not being logged into the VPN, but then they logged in to the VPN and still got the same error.

We're checking with my organization's IT people to see if they did anything different when setting up the guest users & licenses for this supplier, but I don't think we had many differences when setting them up.

I'm at a bit of a loss for what may be causing this issue, any more information, advice, &/or help is appreciated.

Thanks,

EDITs: 

11/10/2023
Still having issues even after the supplier tried turning off their VPN & firewall settings.

[takolota]

They have direct access & are assigned the security roles. We know it is not either of those because the app goes & mostly loads, but then gets caught up when the connectors pop-up shows asking to fix their connections.

[AbdulWahab]

Hi @takolota ,

Its a very strange behavior. Usually, Canvas apps do not pop up to allow dataverse connections. Let me try to reproduce the issue at my side. 

If you need additional help please tag me in your reply and like my reply.

If my reply provided you with a solution, please mark it as a solution

Thanks
Regards,

Abdul Wahab
Power Platform & Customer Engagement Developer/Lead/Solution Architecture/Project Manager
Direct/WhatsApp:+923323281237
E-mail: abdulwahabubit@outlook.com
Skype: abdul.wahabubit
Linkedin: https://www.linkedin.com/in/abdul-wahab-a5b8b011a/
Youtube Channel: https://www.youtube.com/channel/UCBjgLqLK_2kU-3bwo4McrTw
Twitter: https://twitter.com/Abdulwahabubit
GitHub: https://github.com/AbdulWahabWarind

[GB_Sun]

@takolota, did you find a resolution to this issue?

I'm having the same issue when setting up the Microsoft Expense Mobile app. As you said, it appears to load then gets caught up and returns the same error you’ve encountered.

[takolota]

I created a new app using a standard app template & added all my connections to it. I’m now going through the process of continually removing some connections before having the guest users try to access it so I can eventually narrow down which specific connection is causing the issue.

[David_MA]

Does everyone who is accessing the app have a premium license? If so, then it's probably not a license issue but I am not 100% sure about how this works with externals.

[takolota]

@David_MA 
Yes everyone is auto-assigned licenses and none of our other suppliers with the same set-up are having issues.

[takolota]

Oh and we got word that this supplier worked with their IT to turn off the firewall and turn off their VPN and they still had issues.

Updated picture:

[Power_Kassu]

Hello!

I'm having really similar issue and unfortunately can't provide a solution yet, but I'm adding my details if this helps to solve both of problems. I have a canvas app that is shared for external users for company B. Similar to you, only one of the employees for company B is having issues with signin in to dataverse.

Additionally to error message "We werent able to add this connection", my user is provided with this extended error message: Input parameters are invalid. See details for more information. Details:OAuth2Certificate Authorization Flow failed for service Dynamics CRM Online Certificate. Sign-in with Azure Active Directory account xxx failed, due to a tenant isolation policy for tenant xxx

Here's some more info about my case: https://powerusers.microsoft.com/t5/Power-Apps-Governance-and/Can-t-sign-in-dataverse-due-to-a-tenan...

I tried to look for Azure AD sign-in log and the error reason was: "The refresh token was issued to a single page app (SPA), and therefore has a fixed, limited lifetime of {time}, which cannot be extended. It is now expired and a new sign in request must be sent by the SPA to the sign in page. The token was issued on {issueDate}."

Did you check your AAD sign-in log error?

[takolota]

UPDATE: We received a response from Microsoft on the network trace.  The findings are the supplier's tenant has tenant isolation policy enabled which is blocking the connection.  We are trying to resolve now by reaching out to one of the Supplier's tenant admins.

[Power_Kassu]

That's good news! I was suspecting the same issue, I'll try to do the same.

Thanks for sharing!