Flow().RUN Error - Connection not configured for this service

[ricchiuto]

I have an app that invokes multiple flows. The app and flows exist in a solution and there are two environments (DEV & PROD). Everything works as expected in DEV, but when I import the solution into PROD, there are two users who get an error when completing the action(s) that invoke these flows.

It works with the service account used to create the solution, it works for two of the users, but for these other two particular users, they see this error consistently. I've tried to update/upgrade, delete/re-add the solution. All of the permissions are identical to the DEV environment.

Any thoughts on what to try?

[Maltener]

All flows are in the same solution as the app. 
All flows use only connection references.

What I noticed is that there are no security roles active for any of the users on the prod environment. 
Same applies to my sandbox environment but there users don't face issues when using the app. 

Are security roles required to be assigned to users on production environments?

[Pstork1]

Make sure in the production environment that the users have access to the data sources used by the apps and flows. Otherwise, yes you will need to add users to at least the Basic User role, or some version of that.

[Maltener]

All users have access to everything they need. All was working in the dev environment, data sources and their settings didn't change when moving the solution to the prod environment. 

I was playing with security roles yesterday. I added a security role to a test user. The user was then able to use the app. Then I removed the security role from that user again. The user was still able to use the app. 

I am getting very confused with this error.

Ultimately I just added the security role to the environment's team so every user has the same role "assigned" and it seemed to have solved my issue (for now).

Still don't understand why it worked when adding an individual security role and it still works when removing the role from the user again. I would expect it stops working when removing the role. 

Also I don't understand why in the prod environment I need to use security roles at all to make it work.

Honestly, I would like to understand the sandbox situation: Why don't I need security roles there? Everything seems to work without even needing to think about assigning security roles.

[Pstork1]

Take a look at this article. Users don't have access to things in an environment until they've had at least one security role assigned to them in Dynamics 365. In your Sandbox, is it possible that the Sandbox environment is secured using an AAD Security Group?  That's the common thing to do with a Sandbox. If so that would have assigned the users in the group a Basic Security role and give them access. Production environments usually aren't set up with a specific Security group.  That would account for the difference.

Control user access to environments: security groups and licenses - Power Platform | Microsoft Learn

[Maltener]

If a security role has been assigned to users in the sandbox, wouldn't I see it when I click the "manage security roles" option for a user? When I did this, no user I selected had anything assigned in the sandbox.

[Maltener]

Did you forget a link to the article you were mentioning?

[Pstork1]

Sorry, I edited the original post and added it. Control user access to environments: security groups and licenses - Power Platform | Microsoft Learn

[Pstork1]

You wouldn't see it if the role was assigned because the user was a member of the security group.

[RobMolenaar]

I have a DEV, TEST and PROD environment.
In DEV and TEST environment I don't have the problem. Only in the PROD environment.

We fixed it by assigning the "App Opener" security role to the default org team via the Power Platform Admin Center.

Environments > Your Target Environment > Settings > Teams

1. Look for your default business unit team
2. Manage Security Roles 
3. Add the App Opener security role

The App opener security role has "Organization level" read access to the "Process" table/entity (Dataverse system table) which is somehow required in the target environment, for normal users to trigger flows from power apps. Strangely, this is not required in the source environment.

[Maltener]

I did exactly this for my environment as well. Hundreds of users were then able to access the app and use it properly. 
But still some of the users report the issue, same error that the connection is not configured.. 
I then assigned the same security role to the user who reported the issue again and it worked. I still don't really understand why it works only for most and not for all when assigning security roles to the entire Team which is linked to the environment.