Workflow is getting Suspended for some users - Access denied. You do not have permission to perform this action or access

Question

Workflow is getting Suspended for some users and for others it is working and all are given access through same Domain group "Everyone" is given "Edit Control" workflow app permissions is also enabled in site features

https://domainname.sharepoint.com/sites/Sitename/_api/sp.utilities.utility.SendEmail Correlation Id: dbd834f6-be94-882a-a8d1-1deac8ce2268 Instance Id: 439ad8e8-f9c9-4153-818d-b24613ffd69a Access denied. You do not have permission to perform this action or access this resource.

workflow is getting suspended when i checked the log it is trying to send an email and is suspending the workflow. once the workflow is terminated i am seeing this error

RequestorId: dbd834f6-be94-882a-0000-000000000000. Details: System.Activities.Statements.WorkflowTerminatedException: The instance has been moved from the Suspended state to the Terminated state because it has expired. The original error which caused it to be Suspended is: An unhandled exception occurred during the execution of the workflow instance. Exception details: System.ApplicationException: HTTP 403 {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}} {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"X-MSDAVEXT_Error":["917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically."],"X-SP-SERVERSTATE":["ReadOnly=0"],"DATASERVICEVERSION":["3.0"],"SPClientServiceRequestDuration":["75"],"SPRequestDuration":["144"],"SPRequestGuid":["dbd834f6-be94-882a-ac39-db6ac52804c3"],"request-id":["dbd834f6-be94-882a-ac39-db6ac52804c3"],"MS-CV":["9jTY25S+KoisOdtqxSgEww.0"],"Strict-Transport-Security":["max-age=31536000"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["16.0.0.7004"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1; RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Thu, 19 Oct 2017 13:30:52 GMT"],"P3P":["CP=\"ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI\""],"Server":["Microsoft-IIS/8.5"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]} at Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) at System.Activities.CodeActivity.InternalExecute(ActivityInstance instance, ActivityExecutor executor, BookmarkManager bookmarkManager) at System.Activities.Runtime.ActivityExecutor.ExecuteActivityWorkItem.ExecuteBody(ActivityExecutor executor, BookmarkManager bookmarkManager, Location resultLocation) Exception from activity Throw If Sequence Sequence TryCatch Sequence Microsoft.SharePoint.WorkflowServices.Activities.RetryForEmail HttpPost Sequence If Sequence Microsoft.SharePoint.WorkflowServices.Activities.Email 1 Parallel Assigning ProcessLeader Sequence Flowchart Sequence Proposal Request WF.WorkflowXaml_98d798a2_a08d_45e2_9e6d_1322e56dc87f

Answer 1

I realize this is an older thread, but when I ran across this exact issue, here are the steps I used to resolve the problem:

1. Enable Workflow can use app permissions in Site Settings.
2. Enclose the workflow steps in App Steps.
3. Before publishing the workflow, de-select Automatically update the workflow status to the current stage name

Hope that helps someone!

Answer 2

How did you change the workflow?

To troubleshoot the issue, check things below:

1. Set the login automatically in IE. Go to IE->internet options->security tab->custom level->user authentication->automatic logon with current user name and password.

2. Use a browser's private mode and login with the problematic user and tick the Keep Me Signed In box.

3. Grant the problematic user with full control permission to check the result.
4. Check the differences between the problematic users and normal users.
5. Check if the problematic users are in the SharePoint group. If not, add the problematic users into the SharePoint group and grant permission for the SharePoint group in the list which is associated to the workflow.
6. Create a new simple workflow to send email to check if the same issue will occur.

Best regards,

Sara Fan