HTTP with Azure AD - Failed with error: 'AADSTS500011: The resource principal named X was not found in the tenant name Y

[janmechtel]

I'm trying to use HTTP with Azure AD to sign in with Azure AD before making a get request to bamboohr.com.

After clicking "Sign in" I'm asked to sign in with azure which works fine. Then I receive the below error.

Signing into x.bamboohr.com in the browser works fine.

How can this be fixed?

[manuelstgomes]

HI @janmechtel 

I'm not an expert in Azure AD, but looking at the exception, it sounds like you don't have permissions to access with Flow to it.

Are you the admin of your tenant? If not, you need to talk with him/her to figure out what permission is necessary to set up a connection in Flow.

Hope this helps

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
​
Cheers
Manuel

[janmechtel]

Thanks @manuelstgomes. I'm not the admin indeed.

Would you have any idea what such a permission would be called?

Is it a permission on user or on application level?

[manuelstgomes]

HI @janmechtel 

I did a quick search, and I think you need a "Directory.Read.All", based on the document below: 

https://www.anupams.net/extended-attributes-azure-ad-ms-flow/

Please let me know if this solves your problem so that I can learn also 🙂

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
​
Cheers
Manuel

[janmechtel]

Thanks for the hint. I can't really make the relation from there to why HTTP with Azure AD would fail.

As the permission is not flow related but rather what can the app do on the Azure AD / profile side.

Thanks anyway.

[manuelstgomes]

Hi @janmechtel 

Yeah, the permission is on the Azure AD side.

You should test with your administrator to see if the permission above works or if another one is necessary.

No other permission from the Flow side is necessary.

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
​
Cheers
Manuel

[manuelstgomes]

Hi @janmechtel 

You're right, but that's not exactly what I meant. There should be somewhere permission from the user that you're able to send emails on their behalf. It can be done in Outlook or by an administrator. In your case, I think, centrally, an administrator should allow you to send emails on behalf of the people that use the Flow. If you don't have that permission, you would not be able to do it.

Makes sense?

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
​
Cheers
Manuel

[janmechtel]

No I get more confused, I'm not trying to send emails either.

All i want my flow to do is authenticate with the external system (bamboohr.com) as the current user and then send a http request with authentication to that system.

[manuelstgomes]

Hi @janmechtel 

It makes sense actually. Flow tries to access and Azure AD says no. So we need to go to Azure AD and let Flow access. But this is centrally so it's out of your hands I think.

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
​
Cheers
Manuel

[janmechtel]

Ok, so you think there is an permission which says something like "Allow access through flow for 3rd party apps" ?

[manuelstgomes]

Hi @janmechtel 

Yep, bingo!

Don't know which one it is, but your admin should be able to help on that.

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
​
Cheers
Manuel

[Robert94]

Hi, how did you fix this?