BadGateway error 502 (access denied) in approval flows

[DanHansen]

Hello,

I see there are other posts about BadGateway, but none of them are similar to what I experience, therefore I am making a new post.

I have an approval flow, which fails after the approver has given his/her approval. I get the error, and I am not sure why, or what it means:

{
  "error": {
    "code": 502,
    "source": "flow-apim-europe-001-westeurope-01.azure-apim.net",
    "clientRequestId": "2df272d3-cb7e-4967-b99f-9cb02dc4a296",
    "message": "BadGateway",
    "innerError": {
      "status": 500,
      "message": "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))\r\nclientRequestId: 2df272d3-cb7e-4967-b99f-9cb02dc4a296\r\nserviceRequestId: b636d29e-d0f6-0000-9a1f-c7a46cf47bfc"
    }
  }
}

My flow is configured like this (I have deliberately only expanded the Approval condition, as this is where the flow fails):

This error happens consistently, everytime someone approves. The users who initiate the workflow, have Edit permissions on the workspace, and the people that can Approve, have Owner permissions.

Any thoughts on the topic would be greatly appreciated.

Best regards,

Dan

[v-yamao-msft · Accepted solution]

Hi @DanHansen ,

Thanks for feedback.

According to your description, users who initiate the workflow have Edit permissions on the library. Please try to set users permission to Full control.

I have made some test on my side. At first, user has Edit permission to the library, when user select an item to trigger the flow, the same error message will be returned.

Then I set user permission to Full control, it then works successfully.

Please take a try with it on your side.

Best regards,

Mabel

[DanHansen]

Thank you Mabel,

This was precisely what was needed to make the workflow function. It is a bit of a security risk for me, because I do not necessarily want the people who initiate this workflow, to be able to have full control over the workspace. But I will figure something out internally.

Best regards,

Dan

[RobWickham]

I'm having the same issue, and my account that I'm using for testing already has full control. It certainly seems poor security practice to exceed the minimal permissions for doing a check-in / approval request just to support "Flow" being able to do something.

{

"error": {

"code": 502,

"source": "flow-apim-msmanaged-na-northcentralus-01.azure-apim.net",

"clientRequestId": "<removed>",

"message": "BadGateway",

"innerError": {

"status": 500,

"message": "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))\r\nclientRequestId: <removed>\r\nserviceRequestId: <removed>"

}

}

}

[DavidVoycer]

Hey everyone,

i just ant to create a Flow for a reply for special Email. The reply contains a File from Onedrive.

The first two Steps work fine, Step 3 doesnt work.

{

"error": {

"code": 502,

"source": "flow-apim-europe-001-westeurope-01.azure-apim.net",

"clientRequestId": "8023a74a-4b06-44a8-b72c-729eb596f3ae",

"message": "BadGateway",

"innerError": {

"status": 502,

"message": "Fehler bei der Anforderung. Versuchen Sie es später noch mal.\r\nclientRequestId: 8023a74a-4b06-44a8-b72c-729eb596f3ae\r\nserviceRequestId: ec2b1ca3-3cd1-4ff7-bdb6-c5825b1ada97",

"source": "office365-we.azconn-we.p.azurewebsites.net"

}

}

}

Hope somebody can help me fix this.

I´m a Flow Beginner.

Greetings,

David

[Laslo]

Hello,

Just change the way the powerapps are run.

Not by the member but by the owner of the flow :

[sperry1625]

@v-yamao-msft ,

This did solve my issue in testing, but I do not want to grant content creators Full Control of the site/Library for the approval to work.  Why is Full Control required for the author of the content and not just the account being used to run the workflow and set the Approval state of the content?

[SVC-shpt]

@RobWickham did you find a solution to that?

[RobWickham]

SVC-shpt,

my users have full control in this document library, but my users are a small group of only those who actually make edits. other users only have view access. it's not ideal, but it's working adequately the way I've scoped down my editors.