LogicApps SignIn fails with Sharepoint connector

Jane 1

When I try to connect to a SharePoint connector in LogicApps, it fails with this error -

Failed with error: 'OAuth2CertificateSharePointOnlineV2 authorization flow failed for service 'SharePoint Online Certificate V2'. MSGraph discovery endpoint https://graph.microsoft.com/v1.0/sites/root/sharepointIds/siteUrl returned status code 400 (BadRequest). Response: { "error": { "code": "BadRequest", "message": "Unable to retrieve tenant service info.", "innerError": { "date": "2020-08-25T02:28:38", "request-id": "e31d1d41-510c-4535-aa4e-3e87a44f54ee" } } }'. Please sign in again.

1 answer

MayankBargali-MSFT 70,221 Reputation points

2020-08-25T05:23:45.847+00:00

Hi @Jane

Looking into the exception details it looks like you are using SharePoint Online and not On-premise SharePoint. Please confirm if it is correct?
If you are using SharePoint online, then there is no gateway needed. I was able to repro the issue if my tenant doesn't have the valid SharePoint online subscription. Please make sure your tenant has a valid SharePoint online subscription.

To view whether your tenant has valid SharePoint subscription please navigate to https://portal.office.com/account/?ref=MeControl#subscriptions

Click on Subscription and see whether you are able to see Sharepoint license for the logged-in user on your tenant.

Updated
In PowerAutomate or LogicApps scenario connection is created before it is possible to know what tenant user is going to access so the only option defaults to the user’s home tenant as today. That is how it works today and there is no workaround. As of now, there is no way to access non-home tenants from PowerAutomate/LogicApps. I will reach out to my documentation team and add this in the document.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.
Jane 1 Reputation point

2020-08-25T06:24:04.037+00:00

Hi MayankBargali-MSFT,

The link didn't allow me to proceed with my GMAIL account, which I am using to login on this Azure subscription.

Context:

I have a Free Azure subscription operated through a GMAIL account.

There is an external organization on whose sharepoint, this GMAIL account has been permitted to manage site/folders.

On this Azure subscription, when I create a sharepoint connection via logic apps, it fails .
Interestingly, when I use an email account of the same organization who's hosting the sharepoint, that connection works.

Do I need to purchase any service to make this connection successful?

Please advise asap.

MayankBargali-MSFT 70,221 Reputation points

2020-08-25T08:26:53.627+00:00

Hi @Jane

This link will only work for your work or school account. I have tested it using Gmail account at my end. The Azure subscription is in the different tenant that the SharePoint online subscription. I was able to authenticate the request without any issue at my end. It looks like the request is getting failed from the Sharepoint end since you don't have access to get the tenant details for the SharePoint online on your client environment. You can collect the fiddler traces at your client (where you have logged in to the azure portal by performing the operation) and confirm by looking into the traces that the request is denied from SharePoint end. It looks like the logged-in user should have tenant access to retrieve the information of the tenant. You need to reach out to your client SharePoint admins for access.

This will work fine if you create the logic app in the same tenant as both are in the same tenant therefore the tenant details called would not be required.

Jane 1 Reputation point

2020-08-25T08:36:01.533+00:00

Hi , I don't think giving permissions at tenant level would be possible. anyway, in your test, when you gave access to the gmail account to the sharepoint online , what exact steps did you follow ?

Jane 1 Reputation point

2020-08-26T02:01:25.21+00:00

Hi,
I spoke to my admin and he suggests that this gmail account has all the relevant access.
Also could it fact this GMAIL account needs Office365 access as well ?

Can you share what specific grants you provided to your GMAIL account?

MayankBargali-MSFT 70,221 Reputation points

2020-08-26T02:46:31.717+00:00

Hi @Jane

I misunderstood your initial comment. I have used my Gmail account who is in the different tenant having access to an Azure subscription but to authenticate I was using the account that was present in the same tenant as of SharePoint online.

In PowerAutomate or LogicApps scenario connection is created before it is possible to know what tenant user is going to access so the only option defaults to the user’s home tenant as today. That is how it works today and there is no workaround. As of now, there is no way to access non-home tenants from PowerAutomate/LogicApps. I will reach out to my documentation team and add this in the document.

Jane 1 Reputation point

2020-08-26T03:24:16.403+00:00

Hello MayankBargali-MSFT
Just to simplify my understanding, are you concluding that -
that on a Azure Subscription (which is being operated through a GMAIL account or through any other email provider), if I try to create a LogicApp which needs to connect to SharePointOnline of another Organization (say https://luckygroupe.sharepoint.com/), through the same GMAIL account , then it will never work even though this GMAIL account has been granted access on the luckygroupe sharepoint site. Is this a correct understanding ?

And from Solution standpoint, the only way sharepoint connection in LogicApp would be successful, if I use an email account which belongs to the Organization that is hosting the sharepoint online. And in this example it could be something as anyuser@luckygroupe.com with Sharepoint access. Is this a correct understanding ?

Please suggest so that I can change the architecture accordingly.

Regards

MayankBargali-MSFT 70,221 Reputation points

2020-08-26T05:53:38+00:00

Hi @Jane

Yes, your understanding is correct on both points.

Jane 1 Reputation point

2020-08-26T06:14:12.363+00:00

thanks for the clarification. I'll amend my architecture.

Having said that , please raise this requirement with product team about this feature.

Thanks for your support. !!

MayankBargali-MSFT 70,221 Reputation points

2020-08-27T07:31:14.157+00:00

You can always reach out here for any product feedback and improvement. The product team is continuously monitoring them and improving the services. I will pass this feedback to my team.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

LogicApps SignIn fails with Sharepoint connector

1 answer

Your answer