Authentication error

Maizoua · ‎07-30-2019

When I tried to create a canvas app with PowerApps, I get a pop up to authenticate. Once I click authenticate, the pop up refresh but does not go away.

This is the error that I am getting:

Unable to obtain access token for resource 'https://service.powerapps.com/'. Error from ADAL.js: login_required (AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com).
Trace ID: 5f5cfc05-fb94-4d1e-bc11-d626d4ef1900
Correlation ID: d7e66c17-4219-4aeb-aff1-6df46635c9d2
Timestamp: 2019-07-30 15:13:16Z).

I tried clearing all cache and used Chrome in incognito mode but nothing seems to help.

iAm_ManCat · ‎07-31-2019

Hi,

Have you tried adding *.powerapps.com to your trusted sites from IE? The message states that your sites are potentially in different Internet Zones, which can affect data transference between them - particularly worth looking at where login.microsoftonline.com is situated in terms of zones and to add *.powerapps.com to that,

Let me know how you get on with that,

Cheers,

ManCat

@iAm_ManCat

My blog

Please 'Mark as Solution' if someone's post answered your question and always 'Thumbs Up' the posts you like or that helped you!

Thanks!
You and everyone else in the community make it the awesome and welcoming place it is, keep your questions coming and make sure to 'like' anything that makes you 'Appy
Sancho Harker, MVP

Maizoua · ‎07-31-2019

Where do I go to check what zone I'm in? How do I add .powerapps.com to login.microsoft.com?

iAm_ManCat · ‎07-31-2019

Hi,

In your Internet Explorer > Click the settings 'Cog' > Internet Options> Security

From here you can click the Sites button for each of the listed Security Zones (Internet, Local Intranet, Trusted Sites etc) and find out where your login.microsoft.com is situated within those, then add "*.powerapps.com" to that section (without quotes).

If you are still having issues its maybe worth checking with your IT department to see if they can't help you with why the two sites are in different Security Zones, as this may be intentional from their side.

Cheers,

ManCat

@iAm_ManCat

My blog

Please 'Mark as Solution' if someone's post answered your question and always 'Thumbs Up' the posts you like or that helped you!

Thanks!
You and everyone else in the community make it the awesome and welcoming place it is, keep your questions coming and make sure to 'like' anything that makes you 'Appy
Sancho Harker, MVP

ADobin · ‎07-31-2019

@Maizoua since you are using Chrome can you confirm if you have "Block third-party cookies" on? You can see if you do by following the instructions here from Google in the section labeled "Allow or block cookies by default". If you do, you can turn that off for now as a workaround to be able to login.

beebul · ‎10-22-2019

@Maizoua @ADobin

Well it all comes down to trusted sites being manually added to IE to fix IE and Edge issues and Third Party Cookie exceptions being added to Chrome and Firefox.

For example if you want your users to be able to be able to use PowerApps and Microsoft Forms in Google Chrome without issue you need an organisation-wide policy to allow chrome to accept the following 3rd party cookies.

Chrome

login.microsoftonline.com

forms.office.com

apps.powerapps.com

powerapps.com

microsoftonline.com

However - I think that this needs to be communicated better on the Microsoft side – because lets say a person works on a form for a month and then rolls it out to an organisation and no-one else can load the form, that is a problem.

The error messages need to be more descriptive for example an error message that says “Sorry there has been a disconnect” doesn’t help me or the user… also in MS Forms when certain cookies are blocked the form loader just spins around forever and nothing happens, this is poor communication from the application side.

There needs to be clear messages ON SCREEN that say “We are having problems loading this content because your browser is blocking cookies – please contact your helpdesk”.

I think this is actually a problem that needs work on the Microsoft side - because out-of-the-box browsers such as Firefox will not accept any third-party cookies by default.. so you are going to find lots of your customers having problems in the future.

And also note these are just if you want them to use the App Player in their browser - there are additional cookies that need accepting if you want them to use PowerApps studio!

Couldn't everything been centralised so that everything comes under the umbrella of a cloud domain , e.g:

https://powerapps.microsoftonline.com
https://apps.powerapps.microsoftonline.com
https://forms.microsoftonline.com

And then we would just need a policy of

https://*.microsoftonline.com

nishantrana · ‎07-03-2020

This should help fixing the issue

https://tinyurl.com/y8lzcyme

DataJake · ‎07-08-2020

We've got the same issue at my organisation. We have a custom business app with its own in-built browser which is preventing sign-in on Android only, it seems to work just fine on IOS in the same in-app browser. I'm trying to work with our external app developers to fix this, any ideas on what they can do to implement a fix for in-app browser on the android build?