[CoE Starter Kit - BUG] Office 365 Management API error

[RemzoA]

Describe the issue

Hi.

After updating to the latest version of the CoE kit, I am now not able to get the audit logs using the Custom Connector.
When I have updated the CC with the correct information, and then run a "StartSubscription" test, I`m getting the following message:

Operation failed (401), see response below:
Status:
(401)
Headers:
{
"cache-control": "no-cache",
"content-length": "61",
"content-type": "application/json; charset=utf-8",
"date": "Wed, 08 Mar 2023 07:18:41 GMT",
"expires": "-1",
"pragma": "no-cache",
"www-authenticate": "Bearer error="invalid_token"",
"x-aspnet-version": "4.0.30319",
"x-ms-apihub-cached-response": "true",
"x-ms-apihub-obo": "false",
"x-powered-by": "ASP.NET"
}
Body:
{
"Message": "Authorization has been denied for this request."
}

I have the App reg set up with API Permissions as following:

Microsoft Graph:
User.Read - Type: Deleaged - Status: Granted
Office 365 Management APIs
ActivityFeed.Read - Type: Delegated - Status: Granted
ActivityFeed.Read - Type: Application - Status: Granted
ServiceHealth.Read - Type: Delegated - Status: Granted
ServiceHealth.Read - Type: Application - Status: Granted
PowerApps RunTime Service
user_impersonation - Type: Delegated - Status: Granted

Client secret is not expired.

I have the Power Platform Admin role, and it`s active.

When the Child Admin | Sync Logs flow is running, it gets to the action: "List audit log content" where it gets an error saying "Authorization has been denied for this request".

This was working yesterday before I updated to the newest version.

Expected Behavior

Expected is to be able to gather Audit Log data.

What solution are you experiencing the issue with?

Audit Log

What solution version are you using?

3.3

What app or flow are you having the issue with?

Child - Admin - Sync Logs

Steps To Reproduce

No response

Anything else?

No response

[manuelap-msft]

Hello. Connections to custom connectors get broken on solution upgrade. Please see issue 1424 for how to resolve

Note also that there was a recent product change in which the default identity provider for setting up a custom connector has changed from Azure Active Directory to Generic Oauth2. Please see #4808 for our bug to update the documentation about this next release.

[RemzoA]

Hi.
Thanks for the info.
I have done everything that was stated in the information, but it still did not work for me. I was still getting an error on the connection to the Custom Connector from the Child Flow, and still when I did a test of the Custom Connector, I`m got the error message. "Authorization has been denied for this request".

I also tried to delete the Audit Log solution and import it again, but still same got issue.

But, I noticed that in the setup of the Custom Connector, there is a field named "Enable on-behalf-of-login", and that the value of this was set to "false", as it is in all the pictures in all of the information.
Just out of curiosity, I changed this to "true", tested, and it worked. Not sure why, but if I change it back to "false", it stops working.

In addition, I have to say that this us extremely frustrating. Every time there is a new version of the CoE kit, something goes wrong, and this leads me to ask the question, how well are the new versions tested before they are launched?

[manuelap-msft]

Glad you got this working, and thanks for letting us know what you did to get it working - that will help us help other customers.

Unfortunately product changes like the one that happened with custom connectors, where both the default provider as well as some of the required fields to configure authentication changed, are out of our control. We tested the release and component before go live, and about a week after the release of this version the custom connector interface itself changed. This change was not related to the CoE kit, and would have impacted any custom connector you're configuring. The platform evolves all the time, and sometimes we have to play a little catch up.

[Jenefer-Monroe]

I did a full write up for this situation since so many people are hitting it. Please see issue 4961

[Jenefer-Monroe]

closing out as no further action for starter kit team