User not able to execute flow within the application

[RobinHenriksen]

Hi!

I'm having some problems sharing my application with two of my colleagues (or really everyone in my organization). Specifically the two users I've shared my application with recently is not able to execute some of the flows from within the application. When saying not able to execute I mean not able to run the flow at all. However, this does not apply to all of the flows.

All flows etc. are included in the solution.

Data source: Sharepoint

The users get two different error messages.

This user have access to the development environment.
Copydatafromtasklist.Run failed: {"error":{"code":"0x80048306","message":"Principal with id ... does not have ReadAccess right(s) for record with id ... of entity workflow. Details: {\"CallerPrincipal\":{\"PrincipalId\":\"...\",\"Type\":8,\"IsUserPrincipal\":true},\"OwnerPrincipal\":{\"PrincipalId\":\"...\",\"Type\":8,\"IsUserPrincipal\":true},\"ObjectId\":\"...

This user does NOT have access to the development environment.
UpdateCompletecolumninTaskList.Run failed: {"error":{"code":"0x80042f09","message":"RetrievePrivilegeForUser: The user with id ... has not been assigned any roles. They need a role with the prvReadWorkflow privilege."}}

I should add that I have shared this solution / app with two other users before Christmas and it works for them. These two users were also added to the "same" solution in my "Personal Production" environment before I exported the solution to the development environment in mid December. None of these two users have access to the development environment AFAIK.

If I share the flow as "Run-only users" it seems to work. However, I would prefer not to do this for all my individual flows.

The way I understand the documentation it should be sufficient to share a solution with the user and not share each individual flow as well. It is also the way it works for the two previous users I've shared the application with.
https://learn.microsoft.com/en-us/power-apps/maker/canvas-apps/share-app-resources

I've found others struggling with the same issue, and it seems like the way to solve it is to add users to security roles in the environment, but I don't have permission to do this, and I assume it would be better to find another fix if possible.

https://powerusers.microsoft.com/t5/Microsoft-Dataverse/Dataverse-Security-Roles-Solution-with-Share...
https://powerusers.microsoft.com/t5/Power-Apps-Governance-and/RetrievePrivilegeForUser-The-user-with...

One of my colleagues asked if there was anything special with the flows that this occurs for (which is by the way most of the flows).

My answer to him was.
I'm not sure what is special with the flow which this occurs. I've tested this with one more user now. I got two basically identical flows. One works and the other doesn't. This applies to all three users (initially, I'll explain in the end). They have the same connection references, both linked to the solution etc.

Working flow:

Not working flow:

Working flow:

Not working flow:

When saying it applied to all three users initially i refer to this.

"Another strange behavior I noticed is when I shared one of the flow as "Run only users" it worked for both as expected, then I removed the permission for the two users again, and the flow still worked for one of them (the one outside the environment). Not for the other one though."

I've recreated this with user number two now. I had him as "Run only users", it worked, I removed him again, and it still works. This happened the second time we did this. The first time it stopped working when I removed him from "Run only users". The flow I refer to as the working flow has worked for all three users on the first try without doing anything special.

So by looking at these two flows I'm unable to pinpoint anything that can be causing this problem. 

I can also add that user number two changed web browser from chrome to edge after I removed the permission on the "not working" flow, and it still works in edge, so I don't think this weird behavior of the flow working after the permission is removed is related to cookies at least. Maybe the connection fixes itself when they run it with "Run only users" permission, and when I remove the permission the connection continues working.

[BCLS776]

I believe your fix for this is to create a Security Role, with read access to the Process and Solution tables in that environment. You can add users to the Security Role in the Power Platform Admin panel.

Hope that helps,

Bryan

[RobinHenriksen]

That would probably work according to the links that I've linked to in my post, but my solution already works for two users which do not have any security roles added so I find it puzzling that suddenly the three new users that is trying to use the application today / yesterday needs it. I would guess that there is some other kind of solution here, which doesn't involve me contacting the environment admin every time someone needs security roles. This environment is used for other application as well which works fine without having to add security roles AFAIK. I would also think that if the security roles are needed none of the flows would work? 

I've tested it with another user now, and again the flow doesn't work. I add him as "Run only users" and it works. Then I remove him again from "Run only users" and it keeps working for him. The flow that is basically identical worked for him as well as it did for the other users.

It seems like 3 of my 11 flows works on the first try for a new user. Then I can add the user to "Run user only" and remove him to get other flows to work. However, I don't want to do this for the whole organization. 1 of the working flows was created in this environment, while the two others was created before I exported the solution.

I think I will wait until tomorrow and see if this issue fixes itself. Maybe there is some synchronizing issue in the system, as I'm sharing the solution with the whole organization.

[RobinHenriksen]

I recreated one of the flows that was not working and the new recreated identical flow seems to work fine, so one solution for me would be to recreate all the flows that are not working. I don't like this solution as I still don't know what is causing the problem, but it is a solution nonetheless.

If no one has any other suggestions before the end of the workday I'll will mark this as solved on the basis of recreating the flows.

[RobinHenriksen]

It seems to also work to just remove the flow from the solution and application, and then add the same flow back again. This is probably just a bug that happened after exporting the solution from one environment to another. 

[PaulD1111]

Hi @RobinHenriksen,
I am facing the same issue in an app that I am working on. Did recreating the flow fix this issue for all of your users?

[RobinHenriksen]

Late reply, but yes. I did not even have to recreate the flow. Removing it from the application and adding it again was enough.

However, I am facing the same issue now, but since the solution is a managed solution in the new environment I'm unable to add the flows back again after removing them.

[RobinHenriksen · Accepted solution]

Actually, I learned from the post linked below that it is enough to refresh the flows from within the application and republish it. After doing this it seems that the problem is fixed. However, I do fear that I must do this every time, but at least its a solution that works, even in managed solutions.

https://powerusers.microsoft.com/t5/Microsoft-Dataverse/Flow-s-connection-not-provided-after-exporti...

[luginaqolbyj]

Hi,

it also happened to me, and I tried your solution to refresh the flow in the app. It works like a charm! Thank you.

[Oskarkuus]

I have this issue and i can not get any solution to fix this.

the error is:

TeamsyncDeleteTeam.Run misslyckades: {"error":{"code":"0x80048306","message":"Principal with id 3537d5d3-83f6-ee11-a1fd-000d3a39b91a does not have ReadAccess right(s) for record with id 58deb769-4ede-ee11-904c-000d3ab24d75 of entity workflow. Details: {\"CallerPrincipal\":{\"PrincipalId\":\"3537d5d3-83f6-ee11-a1fd-000d3a39b91a\",\"Type\":8,\"IsUserPrincipal\":true},\"OwnerPrincipal\":{\"PrincipalId\":\"2314af6b-0605-ee11-8f6e-000d3a49c465\",\"Type\":8,\"IsUserPrincipal\":true},\"ObjectId\":\"58d...

I have tried

1. Remove the whole solution and import it as new.

2. Go to the application in dev enviroment and update the flow in the app

3. Remove the flow fro the app in dev enviroment

4. Recreate the flow and add it as a brand new flow to the app in dev enviroment.

Nothing works.

The only thing that works is to create a custom layer in the Production enviroment and go into the app and resave the application after updating the flow.

But i cant have this as a solution since the application need to be able to update constantly from the dev enviroment and i cant have custom layers in the production enviroment.

How to fix this?