Intermittent error on "Grant access to an item or folder" action

[hilary_stoupa]

Occasionally, on a "Grant access to an item or folder" action, we get an error like this:

"body":{"status":404,"message":"Couldn't resolve user <userEmail>...etc

• If I try again to grant access to the item in a test Flow, for the same user, the action succeeds. 
• If I resubmit the failed run again, it sometimes succeeds, and sometimes doesn't.
• If I set up a test and just use an Office 365 Get User Profile action for the very same email, it returns information.

When the action fails, we get a "not found" error - but the outputs have the information about not being able to resolve the user.

What might cause this? Any thoughts on how to error handle for this?

[jinivthakkar]

@hilary_stoupa I tried this at my end and it is working as expected 

not sure why it is failing at your end, there is an action which may be you can try using 

I think you can have a dummy list which has a person column, pass your value to this action first if this works then pass it to grant access and then delete the item from list.

--------------------------------------------------------------------------------

If this post helps answer your question, please click on “Accept as Solution” to help other members find it more quickly. If you thought this post was helpful, please give it a Thumbs Up.

[MarkBandR]

I am seeing the same thing you are. I have tried to post a reply with the work around I used, but neither has shown up.

I have switch to setting the Permission using "Send an HTTP request to SharePoint" actions. Since doing that, I have not any issues setting Permissions.

This article by  benfetters is excellent and has specific details:

https://powerusers.microsoft.com/t5/Power-Automate-Community-Blog/Power-Automate-and-SharePoint-Perm...

[MarkBandR]

These are the steps I use:

1) build a string Variable called permissionUsers.

2) add each email address to the string separated by ";" like you would do with the "Grant access to an item or folder" action.

3) use a "Compose" Action to split the string:    split(variables('permissionUsers'), ';')

4) use an "Apply to each" Action on the Outputs of the "Compose" action

5) use a "Scope" Action to group the next Actions in case any one of them fails

6) in the Scope,

1. use a “Send an HTTP request to SharePoint” to get the user id from the email address: _api/web/siteusers/getbyemail('{item()}')
2. use a variable to build the uri: _api/lists/getByTitle('{variables('listName')}')/items({triggerOutputs()?['body/ID']})/roleassignments/addroleassignment(PrincipalId={body('Send_an_HTTP_request_to_SharePoint_-_Get_User')['d']['Id']},roleDefId=1073741929)
3. use a “Send an HTTP request to SharePoint” to set the Permission using POST

7) after the Scope, add parallel Actions with different "Configure Run After" setting a variable indicating if the Scope completed successfully. Make sure to set the "Configure Run After" for any Actions after the parallel Actions so that the Flow will continue.

[MarkBandR]

My replies keep getting held up. I am new at posting here. I'm not sure if it is the text formatting or the api call text. Let's see if this one sticks.

These are the steps I use:

- build a string Variable called permissionUsers.

- add each email address to the string separated by ";" like you would do with the "Grant access to an item or folder" action.

- use a "Compose" Action to split the string:    split(variables('permissionUsers'), ';')

- use an "Apply to each" Action on the Outputs of the "Compose" action

- use a "Scope" Action to group the next Actions in case any one of them fails

- in the Scope,

   - use a “Send an HTTP request to SharePoint” to get the user id from the email address using getbyemail api call

   - use a variable to build the uri to addroleassignment:

   - use a “Send an HTTP request to SharePoint” to set the Permission using POST

- after the Scope, add parallel Actions with different "Configure Run After" setting a variable indicating if the Scope completed successfully. Make sure to set the "Configure Run After" for any Actions after the parallel Actions so that the Flow will continue.

Refer to this article for specifics: 

https://powerusers.microsoft.com/t5/Power-Automate-Community-Blog/Power-Automate-and-SharePoint-Perm...

The worst thing about the "Grant access to an item or folder" call is that if it fails on one of the users, then it doesn't set the Permission for any of the other users you may have sent it. I also had trouble with the Action when I was testing. In the case where I was providing the email address of a Site Collection Admin, it would not set the explicit Permission (Contribute) for that user. All I could figure what that it would not assign less permission that the user already had. The HTTP request api call did not have any trouble assigning permissions.

[hilary_stoupa]

Got it - so you are setting permissions for each user individually.

But the issue I'm having is that this user DOES exist. In another test Flow, using the exact same values for the grant access step, it succeeds.

Thank you for the work around (and the time you took to detail the steps!) - and we may need to just stop using the grant access step, but if the user is not found for some odd reason part of the time, we still have a user who doesn't have access granted via the Flow and we have to add manually. 

However, I suppose that's better than having the whole step fail.... I guess I just remain baffled why an active user randomly can't be found. 

[MarkBandR · Accepted solution]

I get the exact same error message you are seeing with the "Grant access to an item or folder". The users I am send DO exist.

The flow will fail sometimes. I look at it in Runs. I re-submit and it works. If I keep re-submitting, I will eventually get an intermittent failure again.

By using the HTTP Requests, I have not gotten a failure. The api call to get the user by their email address is working just fine. The reason I am granting permissions for each user individually is because 1. that seemed safest, and 2. that is how the api call works.

I was glad when I saw your post...just to know someone else was seeing the same thing. This workaround was by necessity because I could not trust the "Grant access" Action.

[hilary_stoupa]

Oh, wow - ok, thanks for that additional info. We'll switch this over and just assume the "grant access" action is another unreliable one. Have a great day!

[tpnk]

I had this same problem and after 3 hours I figured out the problem. I decided to post, in case someone else has the same problem.

I kept getting the error: Couldn't resolve user yyyy@xxx.com. clientRequestId: xxxxx when using "grant access to item or folder recipient" in PA flow. I wanted to share a folder with an external quest user.

The solution: I needed to go to SharePoint admin - active sites and change the sharing settings for that specific Sharepoint site to "anyone". The sharing settings for that site was somehow "only people in your organization", although my organization level setting was "anyone".

This page helped to figure out how to find this setting.

https://powerusers.microsoft.com/t5/General-Power-Automate/Intermittent-error-on-quot-Grant-access-t...