This is the situation we are experiencing with one of the apps:

  • We have a Canvas Powerapp that uses SharePoint lists for storing the data. Lists are stored in a newly created Team site.
  • App is shared with some Guest users (They have E3 licences in their tenants). We also gave them permissions on SharePoint site.
  • App uses User().Email to query the lists based on a value in some PeoplePicker (Person or Group) columns.
  • For users in our tenant everything works fine.
  • For guest users everything works fine once we give them permissions. But then, every morning, when they start the app, they do not see any data in it. No error is shown.
  • We debugged the app using the Monitor, and saw that every request to SharePoint ends up with 401 Unauthorized error. This is the response we get:
    "response": {
          "duration": 0,
          "size": 0,
          "status": 401,
          "headers": {
            "Content-Length": 503,
            "Content-Type": "application/json",
            "x-ms-apihub-cached-response": false,
            "x-ms-apihub-obo": true,
            "x-ms-failure-cause": "apihub-token-exchange",
            "x-ms-client-request-id": "[GUID]"
          "body": "Failed to get onbehalfof access token: connectionId=sharepointonline, message=MSGraph discovery endpoint https://graph.microsoft.com/v1.0/sites/root/sharepointIds/siteUrl returned status code 401 (Unauthorized). Response:\r\n{\"error\":{\"code\":\"accessDenied\",\"message\":\"There has been an error authenticating the request.\",\"innerError\":{\"date\":\"2022-08-09T08:38:35\",\"request-id\":\"[GUID]\",\"client-request-id\":\"[GUID]\"}}}"

As soon as the guest user visits the SharePoint site and tries to reload the Powerapp, the data becomes visible in the app and everything starts working normaly. Until the next morning.

We tried to share the app with other tenants and the same thing happens. Some guest users have MFA activated and the others do not, but with all of them we have the same issue.

The question: Is there anything we can do to refresh this token without asking the users to open the SharePoint site in browser, since that is not an option?

  • 1
    Normally, you would probably use something like MSAL but it doesn't look like that's possible in Power Apps. It's probably easier to direct these users to a SharePoint landing page where they click a link to your Power App. powerusers.microsoft.com/t5/Building-Power-Apps/… Aug 9, 2022 at 11:24
  • Thanks for the idea about the link! I don't think this client will like it, but we can discuss it with them. We are using the standard SharePoint Data Source btw, so we shouldn't even think about auth tokens and stuff that happen in the background, but with this power platform you never know what's behind a corner.. Aug 9, 2022 at 11:44


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.