|
1 | 1 | --- |
2 | | -title: Reasons for broken connections |
3 | | -description: Learn how to troubleshoot and resolve broken connections. |
4 | | -services: connectors |
5 | | -ms.service: power-platform |
| 2 | +title: Troubleshoot broken connections |
| 3 | +description: Learn how to troubleshoot and resolve connection problems and ensure a smoother experience with your applications and services in Microsoft Power Automate. |
| 4 | +ms.custom: sap:Connections |
6 | 5 | ms.workload: connectors |
7 | 6 | author: nravindra-msft |
8 | 7 | ms.author: nravindra |
9 | 8 | ms.reviewer: angieandrews |
10 | | -ms.topic: how-to |
11 | 9 | ms.date: 01/16/2025 |
12 | 10 | --- |
13 | | -# Reasons for broken connections |
| 11 | +# Troubleshoot broken connections in Power Automate |
14 | 12 |
|
15 | | -In this article, you will learn about the various reasons for broken connections and how to troubleshoot them effectively. We will cover common issues such as connection timeouts, Data Loss Prevention (DLP) blocks, invalid authenticated devices, and more. By understanding these reasons and following the provided troubleshooting steps, you can resolve connection problems and ensure a smoother experience with your applications and services. |
| 13 | +This article describes the following common issues about broken connections in Microsoft Power Automate and helps you troubleshoot and solve these issues. |
16 | 14 |
|
17 | | -## Reason: Connection time out |
| 15 | +- [Connection times out](#connection-times-out) |
| 16 | +- [A DLP block occurs](#a-dlp-block-occurs) |
| 17 | +- [Invalid authenticated devices](#invalid-authenticated-devices) |
| 18 | +- [Inactivity for a long time](#inactivity-for-a-long-time) |
| 19 | +- [Connection issue related to attended mode](#connection-issue-related-to-attended-mode) |
| 20 | +- [Password modification by a user](#password-modification-by-a-user) |
| 21 | +- [Azure Active Directory (AAD) configuration is changed](#azure-active-directory-aad-configuration-is-changed) |
| 22 | +- [Connection owner account is deleted or disabled](#connection-owner-account-is-deleted-or-disabled) |
| 23 | +- [Tenant administrator disabled the application](#tenant-administrator-disabled-the-application) |
18 | 24 |
|
19 | | -This occurs when a client (such as a web browser or an application) tries to establish a connection with a server, but the server does not respond within a specified time limit. This can happen for various reasons, such as the server being offline, network issues, or the server taking too long to process the request. When the connection times out, the client stops waiting for a response and terminates the connection attempt |
| 25 | +## Connection times out |
20 | 26 |
|
21 | | -Possible error string seen by users </br> |
22 | | -<i>- “The user could not be authenticated as the grant is expired. The user must sign in again.”</i> |
| 27 | +This issue occurs when a client (such as a web browser or an application) tries to establish a connection with a server, but the server doesn't respond within a specified time limit. This can occur for various reasons, such as the server being offline, network issues, or the server taking too long to process the request. When the connection times out, the client stops waiting for a response and terminates the connection attempt. |
23 | 28 |
|
24 | | -Troubleshoot </br> |
25 | | -1. Check your internet connection: Ensure that the internet connection is stable and working properly.<br> |
26 | | -2. Check the server status: Verify if the server you are trying to connect to is online and not experiencing any downtime.<br> |
27 | | -3. Try increasing the timeout limit: Sometimes, increasing the timeout limit will help in getting the connection from the servers. |
| 29 | +You might also receive the following error message: |
28 | 30 |
|
29 | | -## Reason: DLP block |
30 | | -Reason: DLP block |
31 | | -Data Loss Prevention (DLP) is a security measure that prevents sensitive information from being shared or transferred inappropriately. A DLP block occurs when a DLP policy detects that an action, such as sending an email or sharing a file, violates the organization's data protection rules. The DLP system then blocks the action to prevent potential data breaches or unauthorized access to sensitive information |
| 31 | +> The user could not be authenticated as the grant is expired. The user must sign in again. |
32 | 32 |
|
33 | | -Possible error string seen by users |
34 | | -- “Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.” |
35 | | -- “Device is not in required device state: domain_joined. Conditional Access policy requires a domain joined device, and the device is not domain joined.” |
| 33 | +### Troubleshooting steps |
36 | 34 |
|
37 | | -Troubleshoot |
38 | | -1. Review DLP policies: Check the DLP policies configured in the organization to understand what actions are being blocked and why. |
39 | | -2. Consult with your admin: There might be a chance that the admin has blocked the particular connector or connection. It's a good idea to consult with them and discuss the issue to unblock it. |
| 35 | +1. Check your internet connection: Ensure that the internet connection is stable and working properly. |
| 36 | +2. Check the server status: Verify if the server you're trying to connect to is online and not experiencing any downtime. |
| 37 | +3. Try increasing the timeout limit: Sometimes, increasing the timeout limit can help in establishing a connection with the server. |
40 | 38 |
|
41 | | -## Reason: Invalid authenticated devices |
42 | | -Reason: Invalid authenticated devices |
43 | | -This refers to a situation where a user tries to authenticate using a device for multi-factor authentication (MFA), but the device has been disabled. This issue is not related to Power Automate but rather to the tenant's configuration at the administrative level. |
| 39 | +## A DLP block occurs |
44 | 40 |
|
45 | | -Possible error string seen by users |
46 | | -- “Device object was not found in the tenant 'b880eeca-f1fb-4c91-bff6-82e84350a6e6' directory.” |
47 | | -- “Device is not in required device state: compliant. Conditional Access policy requires a compliant device, and the device is not compliant. The user must enroll their device with an approved MDM provider like Intune.” |
48 | | -- "Device used during the authentication is disabled.” |
49 | | -- “Application needs to enforce Intune protection policies.” |
| 41 | +[Data Loss Prevention (DLP)](/purview/dlp-learn-about-dlp) is a security measure that prevents sensitive information from being shared or transferred inappropriately. A DLP block occurs when a DLP policy detects that an action, such as sending an email or sharing a file, violates the organization's data protection rules. The DLP system then blocks the action to prevent potential data breaches or unauthorized access to sensitive information. |
50 | 42 |
|
51 | | -Troubleshoot |
52 | | -1. Reach out to the tenant admin to understand why the device was disabled and to resolve the issue |
53 | | -2. Try re-authorizing the connection |
| 43 | +When a DLP block occurs, you might also receive one of the following error messages: |
54 | 44 |
|
55 | | -## Reason: Due to inactivity for a very long duration |
56 | | -Reason: Due to inactivity for a very long duration |
57 | | -This refers to a situation where a connection becomes invalid because it has not been used for a specified period. For example, the SharePoint connector requires usage at least once every 90 days to remain active. If the connection is not used within this period, it will expire. The suggested troubleshooting method is to either create a new connection or reauthorize the existing one. |
| 45 | +> - Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. |
| 46 | +> - Device is not in required device state: domain_joined. Conditional Access policy requires a domain joined device, and the device is not domain joined. |
58 | 47 |
|
59 | | -Possible error string seen by users |
60 | | -- “The refresh token has expired due to inactivity. The token was issued on 2024-03-17T12:07:02.0086301Z and was inactive for 90.00:00:00.” |
61 | | -- “The provided authorization code or refresh token has expired due to inactivity. Send a new interactive authorization request for this user and resource.” |
| 48 | +### Troubleshooting steps |
62 | 49 |
|
63 | | -Troubleshoot |
64 | | -1. To troubleshoot, user must create a new connection or reauthorize the existing one. |
| 50 | +1. Review DLP policies: Check the DLP policies configured in the organization to understand what actions are being blocked and why. |
| 51 | +2. Consult with your administrator: There might be a chance that the administrator has blocked the particular connector or connection. It's a good idea to consult with them and discuss the issue to unblock it. |
65 | 52 |
|
66 | | -## Reason: Connection issue related to attended mode |
67 | | -Reason: Connection issue related to attended mode |
| 53 | +## Invalid authenticated devices |
68 | 54 |
|
69 | | -This refers to problems that occur when a user tries to use features that require a license for unattended mode but does not have the necessary license. In attended mode, the user must be present and interact with the system, whereas unattended mode allows for fully automated processes without user interaction. If a user without the appropriate license attempts to use unattended mode, the connection will fail. |
70 | | -Learn more about Attended and unattended scenarios here: Attended and unattended scenarios for process automation - Power Automate | Microsoft Learn |
| 55 | +This refers to a situation where a user tries to authenticate using a device for multi-factor authentication (MFA), but the device has been disabled. This issue isn't related to Power Automate but rather to the tenant's configuration at the administrative level. |
71 | 56 |
|
72 | | -Troubleshoot |
73 | | -1. The user must have the correct license to interact with the system as required in attended mode. |
| 57 | +In this situation, you might also receive one of the following error messages: |
74 | 58 |
|
75 | | -## Reason: Password modification by the user |
76 | | -Reason: Password modification by the user |
77 | | -This occurs when the account password you have added to create the connection is deleted or changed or expired. Since account verification is a crucial part of authentication whenever a connection is triggered, the connection will break if new password is not updated. To avoid this, use services like Microsoft Entra ID, learn more about it here |
| 59 | +> - Device object was not found in the tenant '\<TenantID>' directory. |
| 60 | +> - Device is not in required device state: compliant. Conditional Access policy requires a compliant device, and the device is not compliant. The user must enroll their device with an approved MDM provider like Intune. |
| 61 | +> - Device used during the authentication is disabled. |
| 62 | +> - Application needs to enforce Intune protection policies. |
78 | 63 |
|
79 | | -Possible error string seen by users |
80 | | -- “The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2022-07-06T08:47:42.5388987Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2024-08-01T12:39:32.0000000Z'.” |
| 64 | +### Troubleshooting steps |
81 | 65 |
|
82 | | -Troubleshoot |
83 | | -1. Every time user update your password, the existing connections with those passwords would become invalid, so user must create a new connection for each of those connectors or edit the existing connection |
| 66 | +1. Contact the tenant administrator to understand why the device was disabled. |
| 67 | +2. Try re-authorizing the connection. |
84 | 68 |
|
85 | | -## Reason: AAD configuration change |
86 | | -Reason: AAD configuration change |
87 | | -This refers to modifications made at the Azure Active Directory (AAD) level that affect user identities or access policies. These changes can include moving to a new location, altering user roles, or updating security settings. Such changes can invalidate existing tokens and require users to reauthenticate. |
| 69 | +## Inactivity for a long time |
88 | 70 |
|
89 | | -Possible error string seen by users |
90 | | -- “Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000003-0000-0000-c000-000000000000'.” |
| 71 | +This refers to a situation where a connection becomes invalid because it hasno't been used for a specified period. For example, the SharePoint connector requires usage at least once every 90 days to remain active. If the connection isn't used within this period, it will expire. |
91 | 72 |
|
92 | | -Troubleshoot |
93 | | -1. User must reach out to the tenant admin to understand the specific changes and reauthorize the connection if necessary |
| 73 | +In this situation, you might also receive one of the following error messages: |
94 | 74 |
|
95 | | -## Reason: Connection owner account is deleted/disabled |
96 | | -Reason: Connection owner account is deleted/disabled |
97 | | -This refers to a situation where the account that created a connection is either removed or disabled in the directory. This results in the invalidation of the connection, affecting all users who shared the connection. |
| 75 | +> - The refresh token has expired due to inactivity. The token was issued on \<DateTime> and was inactive for 90.00:00:00. |
| 76 | +> - The provided authorization code or refresh token has expired due to inactivity. Send a new interactive authorization request for this user and resource. |
98 | 77 |
|
99 | | -Possible error string seen by users |
100 | | -- “The user account {EUII Hidden} has been deleted from the 1a188ae6-a002-4149-8234-e47371d17cce directory. To sign into this application, the account must be added to the directory.” |
101 | | -- " The user account is disabled.” |
102 | | -- “The user account {EUII Hidden} does not exist in the 66dc1f77-2e0d-4d13-b961-7c2e63aa376b directory. To sign into this application, the account must be added to the directory.” |
| 78 | +### Troubleshooting steps |
103 | 79 |
|
104 | | -Troubleshoot |
105 | | -1. To resolve this, another user with access can reauthorize the connection, thereby updating the ownership and restoring functionalities for all users. |
| 80 | +To troubleshoot this issue, create a new connection or re-authorize the existing one. |
106 | 81 |
|
107 | | -## Reason: Tenant admin disabled the app |
108 | | -Reason: Tenant admin disabled the app |
109 | | -This means that the administrator of the tenant has deactivated an application registered in Azure Active Directory (AAD). This action invalidates any service principal connections associated with the app, as the app can no longer issue tokens. To resolve this, the tenant admin needs to re-enable the app or create a new service principal connection. |
| 82 | +## Connection issue related to attended mode |
110 | 83 |
|
111 | | -Possible error string seen by users |
112 | | -- “The service principal for resource '00000003-0000-0ff1-ce00-000000000000' is disabled. This indicate that a subscription within the tenant has lapsed, or that the administrator for this tenant has disabled the application, preventing tokens from being issued for it.” |
| 84 | +This refers to problems that occur when a user tries to use features that require a license for unattended mode but doesn't have the necessary license. In attended mode, the user must be present and interact with the system, whereas unattended mode allows for fully automated processes without user interaction. If a user without the appropriate license attempts to use unattended mode, the connection will fail. |
113 | 85 |
|
114 | | -Troubleshoot |
115 | | -1. To resolve this, the tenant admin needs to re-enable the app or create a new service principal connection. |
| 86 | +[Learn more about attended and unattended scenarios for process automation](/power-automate/guidance/planning/attended-unattended). |
| 87 | + |
| 88 | +### Troubleshooting steps |
| 89 | + |
| 90 | +Ensure the user has the correct license to interact with the system as required in attended mode. For more information, see [Which Power Automate licenses do I need?](/power-platform/admin/power-automate-licensing/faqs#which-power-automate-licenses-do-i-need). |
| 91 | + |
| 92 | +## Password modification by a user |
| 93 | + |
| 94 | +This issue occurs when the account password used to create the connection is deleted, changed, or expired. Since account verification is a crucial part of authentication whenever a connection is triggered, the connection will break if new password isn't updated. To avoid this issue, use services like [Microsoft Entra ID](/entra/fundamentals/whatis). |
| 95 | + |
| 96 | +You might also receive the following error message: |
| 97 | + |
| 98 | +> The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '\<DateTime>' and the TokensValidFrom date (before which tokens are not valid) for this user is '\<DateTime>'. |
| 99 | +
|
| 100 | +### Troubleshooting steps |
| 101 | + |
| 102 | +Every time a user updates their password, the existing connections with those passwords become invalid, so the user must create a new connection for each of those connectors or edit the existing connection. |
| 103 | + |
| 104 | +## Azure Active Directory (AAD) configuration is changed |
| 105 | + |
| 106 | +This refers to modifications made at the Azure Active Directory (AAD) level that affect user identities or access policies. These changes can include moving to a new location, altering user roles, or updating security settings. Such changes can invalidate existing tokens and require users to reauthenticate. |
| 107 | + |
| 108 | +You might also receive the following error message: |
| 109 | + |
| 110 | +> Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000003-0000-0000-c000-000000000000'. |
| 111 | +
|
| 112 | +### Troubleshooting steps |
| 113 | + |
| 114 | +Contact the tenant administrator to understand the specific changes and reauthorize the connection if necessary. |
| 115 | + |
| 116 | +## Connection owner account is deleted or disabled |
| 117 | + |
| 118 | +This refers to a situation where the account that created a connection is either removed or disabled in the directory. As a result, the connection becomes invalid, affecting all users who shared it. |
| 119 | + |
| 120 | +In this situation, you might also receive one of the following error messages: |
| 121 | + |
| 122 | +- > The user account {EUII Hidden} has been deleted from the \<DirectoryID> directory. To sign into this application, the account must be added to the directory. |
| 123 | +- > The user account is disabled. |
| 124 | +- > The user account {EUII Hidden} does not exist in the \<DirectoryID> directory. To sign into this application, the account must be added to the directory. |
| 125 | +
|
| 126 | +### Troubleshooting steps |
| 127 | + |
| 128 | +To resolve this, another user with access can reauthorize the connection, thereby updating the ownership and restoring functionalities for all users. |
| 129 | + |
| 130 | +## Tenant administrator disabled the application |
| 131 | + |
| 132 | +This means that the tenant administrator deactivates an application registered in Azure Active Directory (AAD). This action invalidates any service principal connections associated with the application, as it can no longer issue tokens. |
| 133 | + |
| 134 | +You might also receive the following error message: |
| 135 | + |
| 136 | +> The service principal for resource '\<ResourceID>' is disabled. This indicate that a subscription within the tenant has lapsed, or that the administrator for this tenant has disabled the application, preventing tokens from being issued for it. |
| 137 | +
|
| 138 | +### Troubleshooting steps |
| 139 | + |
| 140 | +To resolve this issue, the tenant administrator needs to re-enable the application or create a new service principal connection. |
| 141 | + |
| 142 | +## More information |
| 143 | + |
| 144 | +[Manage connections in Power Automate](/power-automate/add-manage-connections) |
0 commit comments