Create item - Access is denied as an site owner?

[WackdeMack]

Hi all,

I have suddenly a very strange error from a flow. I have made an long approval flow. After the first approval the comments of the manager are posting on a list. The flow start from an library.

{
  "status": 403,
  "message": "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))\r\nclientRequestId: c096b4b7-cf67-4a23-98c4-131f5650be39\r\nserviceRequestId: c096b4b7-cf67-4a23-98c4-131f5650be39"
}

Here is the raw input:

{
    "statusCode": 403,
    "headers": {
        "Vary": "Origin",
        "X-SharePointHealthScore": "3",
        "X-MS-SPConnector": "1",
        "X-SP-SERVERSTATE": "ReadOnly=0",
        "DATASERVICEVERSION": "3.0",
        "SPClientServiceRequestDuration": "57",
        "SPRequestGuid": "c096b4b7-cf67-4a23-98c4-131f5650be39",
        "request-id": "c096b4b7-cf67-4a23-98c4-131f5650be39",
        "MS-CV": "t7SWwGfPI0qYxBMfVlC+OQ.0",
        "Strict-Transport-Security": "max-age=31536000",
        "X-FRAME-OPTIONS": "SAMEORIGIN",
        "Content-Security-Policy": "frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.stream.azure-test.net *.microsoftstream.com;",
        "MicrosoftSharePointTeamServices": "16.0.0.20913",
        "X-Content-Type-Options": "nosniff",
        "X-MS-InvokeApp": "1; RequireReadOnly",
        "Timing-Allow-Origin": "*",
        "x-ms-apihub-cached-response": "true",
        "Cache-Control": "max-age=0, private",
        "Date": "Tue, 02 Feb 2021 10:56:51 GMT",
        "P3P": "CP=\"ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI\"",
        "X-AspNet-Version": "4.0.30319",
        "X-Powered-By": "ASP.NET",
        "Content-Length": "225",
        "Content-Type": "application/json",
        "Expires": "Mon, 18 Jan 2021 10:56:51 GMT",
        "Last-Modified": "Tue, 02 Feb 2021 10:56:51 GMT"
    },
    "body": {
        "status": 403,
        "message": "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))\r\nclientRequestId: c096b4b7-cf67-4a23-98c4-131f5650be39\r\nserviceRequestId: c096b4b7-cf67-4a23-98c4-131f5650be39"
    }
}

The flow runs from a service account. The service account is on this site, the site owner so how can then there be an issue with the "Access is denied? " Because the flow runs by the serviceaccount, only the service account needs to have permissions on the lists, normally?

Edit: When i run the flow, it works fine so there is something with the permissions. But i think is so strange, the service account will create the item, so how can there be an access denied?

[tom_riha · Accepted solution]

Hello @WackdeMack ,

how is the flow started? If it's manually started flow then it might be configured to run using connection of the user who started it. And if that user doesn't have access to that list the flow will fail.

The configuration is under the 'Run only users' section on the flow page.