Possible Bug? Major headace sharing Flow with biz

[ryan2k]

I've built a Flow that follows these operations:

1. Triggers base on completing a Microsoft Form (that I've built)

2. Using Form Data, it creates a series of Outlook Calendar events, Outlook Tasks, and SharePoint Folders

3. The Flow does other miscellaneous things, but these are the heavy hitters of the Flow. The Flow has 5 app connections and contains nearly 40 operations.

Expected Results

My goal for this Flow is to share it in my organization so they can fill out the Trigger Form with their unique data, then have the Flow proceed to create the Outlook items on their account.

I'm exporting my Flow as a .zip, having my colleages import the Flow into their Office 365 account, and having them update the connectors with their email addresses by choosing "Select during import"

Actual Results

1. The first issue is that when my colleage fills out the Form (the one I created) it triggers their Flow, as expected. However their Flow reports that it failed to get Response Details from the Form. I would have expected the Flow to stop running at the section noted from the failure. However the Flow indeed continued to run all the way to the end. All the steps that show the 'X' indicating they didn't run, did indeed run.

The error code for Get response details is:

{
  "error": {
    "code": "707",
    "message": "UnauthorizedAccess to CDB. Inner Message: {\"error\":{\"code\":\"OperationForbidden\",\"message\":\"Unauthorized Access\",\"innerError\":{\"code\":\"UnauthorizedAccess\"}}}"
  }

2. The second issue - all of the Outlook Calendar events and Tasks (that shouldn't have ran due to the error, but actually did run) were created on MY Office 365 account. These items should have been created on their account - not mine. We verified upon Flow Import that all the connections they created showed their email address. Why would there still be any ties to my email at all?

My suspicion

I'm suspicious that the root of the issue is how I have the tigger setup to use the Form. In my source Flow, I'm able to click the trigger drop down and select the Microsoft Form - because I created the Form and it's in my Office 365 account. However this Form doesn't exist in my colleage's account, so the Flow is using an ID that copied over in the template. If they click the dropdown to change the trigger, only their Forms (if they have any) show up. I'm guessing Flow doesn't know how to handle sharing the Form ID between exported/imported Flows in different accounts.

Taking that further, Flows thinks it failed due to not finding that Form in my colleages Forms Account (hence the unauthorized access error), so the Flow errored out. However it was still able to read the data and finish running the tasks - the error is a false positive. Again, I'm guessing Flow just doesn't know how to handle this type of use.

This project is critical to my team and my business.

* I cannot simply "Publish" this Flow as template to Microsoft as it contains IP and sentitive information to my business. * I cannot add my entire Team as owners as that would add risk of someone editing/breaking/deleting the source.

Is there an option for a Private Publish? Please help me overcome this major issue!

[AlanPs1]

Hi @ryan2k

I will try and see if I can assit with some of this but may not have all the answers ...

1. If you think you have found a bug, I'd advise posting it here, hence you mention potentially the error is a false positive.

2. Based on the error, it looks like what you report below is accurate, I am about to do the same thing tomorrow and can do this and report back my finds but will need to wait until then.

3. You mention "This project is critical to my team and my business." and go on to say "I cannot simply "Publish" this Flow as template to Microsoft as it contains IP and sentitive information to my business. * I cannot add my entire Team as owners as that would add risk of someone editing/breaking/deleting the source."

Regards point 3, if you have senstive information it is possible to call a Flow from a Flow using HTTP request. What can be done, is that at the point the sensitive information is required you can call the "Private Flow" then when it completes it can call the "Public Flow" and so on. 

@sergeluca covers this in some detail here. Kudos to him!

So I am hopeful some of what I have posted can help you on a little.

If you have found my post helpful, please mark thumbs up.

Any other questions, just ask.

Thanks, Alan

[ryan2k]

Thanks Alan.

#1 Happy to report a bug if you experience similar behavior in your testing.

#2 Appreciate you reproducing the issue

#3 This would unnecessarily complicate things so I'd like to stick with a single Flow

[ryan2k]

Any comment from Microsoft?

[ryan2k · Accepted solution]

For anyone following along down the road... I worked with Microsoft Support to get to an outcome. There were a few things we had to do differently:

1. I had to change the trigger type to a Button instead of triggering off of a MS Form. Turns out you have different sharing options based on the trigger type. Once I changed it to a Button Trigger, I could add a "Managed Run-Only User" which is exactly the type of sharing I needed to my organization.

2. Regarding the Calendar entries/Tasks getting created on the proper account, we also had to do a pull of the current Calendar and Task objects before referencing them. Again - this all worked in the previous config on MY account, but once it was shared it didn't work as expected for my colleagues. After making this change, the objects were created on their accounts as expected.

Thanks!