Flow Approvals cause my Flow to fail

[e_jones]

Hi all,

Yesterday I was testing a fairly complex flow and everything was working fine. One of the components of the flow starts an approval, sends to one approver, and sends an email in response. No big deal and this was working perfectly all of this week. Today, this part of the flow (the "Start an Approval" part) is failing continuously with no reason. I have tried deleting and readding it, recreating my Approvals connector, verified all included emails are legitimate and have the correct permissions, etc. Any ideas? Is this just a service degradation? I don't see any outages in my Service Health center. 

Error message:

Forbidden. The request failed. Response content: '{"status":403,"source":"https://power-te-westus-3.azurewebsites.net:443/tokens/msmanaged-na/approvals/ff28a123d13b417684fda2... from token exchange: Connection msmanaged-na/logicflows/5141db4b-5e02-465b-99d0-4bf7880c62ab@https://msmanaged-na.azure-apim.net/ is not allowed to access connection msmanaged-na/approvals/ff28a123d13b417684fda2d4ea04ba6a"}'.

I came from this thread that discussed multiple-approver issues but this issue seems unique from that one. 

https://powerusers.microsoft.com/t5/Using-Flows/Approval-Flow-is-not-sending-email/td-p/92870

[e_jones]

Note - I'm getting a new error message now: 

Forbidden. The request failed. Error code: 'XrmApprovalsGeneralPermissionsError'. Error Message: 'Encountered a general permissions error trying to access the CDS database. This could be caused by modification of the approvals administrator or user roles, or by an incompatible plugin. Detailed message: 'Message: Principal user (Id=6f80cffe-8b7e-4c6f-8159-f07f88c396aa, type=8, roleCount=3, privilegeCount=555, accessMode=1(Setup/Stub user with filtered privileges from associated roles. Consider changing user AccessMode to Full (without privilege filtering)), is missing prvReadmsdyn_flow_basicapprovalmodel privilege (Id=af12d282-073f-46aa-a381-6ecbe199aad1) on OTC=10011 Code: 0x80040231 InnerError: Type: System.ServiceModel.FaultException`1[[Microsoft.Xrm.Sdk.OrganizationServiceFault, Microsoft.Xrm.Sdk, Version=9.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]] Message: Principal user (Id=6f80cffe-8b7e-4c6f-8159-f07f88c396aa, type=8, roleCount=3, privilegeCount=555, accessMode=1(Setup/Stub user with filtered privileges from associated roles. Consider changing user AccessMode to Full (without privilege filtering)), is missing prvReadmsdyn_flow_basicapprovalmodel privilege (Id=af12d282-073f-46aa-a381-6ecbe199aad1) on OTC=10011 StackTrace: at Microsoft.Crm.Extensibility.OrganizationSdkServiceInternal.CreateInternal(Entity entity, InvocationContext invocationContext, CallerOriginToken callerOriginToken, WebServiceType serviceType, Boolean checkAdminMode, Dictionary`2 optionalParameters) at Microsoft.Crm.Extensibility.OData.CrmODataExecutionContext.CreateOrganizationResponse(Entity entity) at Microsoft.Crm.Extensibility.OData.CrmODataServiceDataProvider.CreateEdmEntity(CrmODataExecutionContext context, String edmEntityName, EdmEntityObject entityObject, Boolean isUpsert) at Microsoft.Crm.Extensibility.OData.EntityController.PostEntitySetImplementation(String& entitySetName, EdmEntityObject entityObject) at Microsoft.PowerApps.CoreFramework.ActivityLoggerExtensions.Execute[TResult](ILogger logger, EventId eventId, ActivityType activityType, Func`1 func, IEnumerable`1 additionalCustomProperties) at Microsoft.Xrm.Telemetry.XrmTelemetryExtensions.Execute[TResult](ILogger logger, XrmTelemetryActivityType activityType, Func`1 func) at lambda_method(Closure , Object , Object[] ) at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ActionExecutor.<>c__DisplayClass10.<GetExecutor>b__9(Object instance, Object[] methodParameters) at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ExecuteAsync(HttpControllerContext controllerContext, IDictionary`2 arguments, CancellationToken cancellationToken) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Controllers.ApiControllerActionInvoker.<InvokeActionAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Controllers.ActionFilterResult.<ExecuteAsync>d__2.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Dispatcher.HttpControllerDispatcher.<SendAsync>d__1.MoveNext() InternalException: ''.

[v-zhos-msft]

Hi @e_jones ,

As the error message shown, you don’t have the permissions to access the CDS database.

For the 403 error, It is an authentication error, please update the connection which has the error to fix the authentication error.

More details about Authentication error, please check the following article:

https://docs.microsoft.com/en-us/flow/fix-flow-failures#authentication-failures

Best Regards,

Community Support Team _ Zhongys

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[CRMDutchess]

Hi @e_jones,

Was this CDS error ever solved for you?

I am experiencing the same when my flow starts an approval.

Thanks,

Carla

[ravi_regal]

Hi @CRMDutchess 

Can you please send detail error log?

---

@CRMDutchess wrote:

Hi @e_jones,

Was this CDS error ever solved for you?

I am experiencing the same when my flow starts an approval.

Thanks,

Carla

---

[e_jones · Accepted solution]

Hi Carla,

Sorry for the delay. This was resolved without any intervention by me so I believe it was just a backend Microsoft issue.