Troubleshooting Approval Adaptive Card Errors for Guest Users in Power Automate

Table of Contents

Power Automate approvals provide a streamlined way to manage requests within organizations, facilitating decision-making processes directly within familiar applications like Outlook and Teams. The integration of Adaptive Cards into approval emails significantly enhances this experience, allowing approvers to review details and take action (approve or reject) without needing to open a separate application or browser window. This feature aims to boost efficiency and improve the overall user experience for both internal employees and external collaborators.

However, deploying solutions that involve external parties, such as guest users invited via Azure Active Directory B2B collaboration, can sometimes introduce unexpected challenges. While guest users can often participate in many Microsoft 365 and Power Platform activities, certain interactions, particularly those involving embedded or API-driven actions initiated from external contexts like an email client, may encounter permission or authentication issues.

This article addresses a specific scenario where guest users encounter difficulties when attempting to respond to a Power Automate approval request directly from the Adaptive Card embedded within the email they receive. Understanding the nature of this problem, its symptoms, and available workarounds or alternative methods is crucial for ensuring your approval processes are inclusive and functional for all participants, regardless of their user type.

Symptoms¶

When an approval request is sent to a guest user through a Power Automate flow, they receive an email containing an interactive Adaptive Card. This card typically displays relevant details about the request and provides buttons or actions to Approve or Reject it directly from the email interface.

However, when a guest user clicks on either the Approve or Reject action button within this Adaptive Card in their email client, the action fails. Instead of successfully processing the request, the user is presented with an error message indicating that the action could not be completed. The specific error message reported in this scenario is:

The remote endpoint returned an error HTTP 403. Please try again later.

The HTTP 403 status code is a standard web server response indicating that the server understood the request but refuses to authorize it. In the context of this Power Automate approval error, a 403 Forbidden error strongly suggests a permission or access rights issue. It implies that the guest user’s identity, or the context in which they are attempting the action (i.e., directly from the email Adaptive Card which calls a Power Automate/Dataverse endpoint), is not authorized to perform the requested operation (approving or rejecting) at that specific endpoint or service.

This issue prevents guest users from utilizing the most convenient method of responding to approvals, potentially delaying processes and requiring manual intervention or instructing users on alternative methods.

Understanding the Technical Context¶

To fully grasp why this issue might occur, it’s helpful to briefly review the components involved:

Power Automate Approvals¶

Power Automate’s approval feature is built upon a sophisticated backend service, often leveraging Microsoft Dataverse (formerly Common Data Service) to store approval requests, responses, and associated data. When an approval action is added to a flow, it creates a record in Dataverse and makes it available to the assigned approvers. The interaction methods (email, Teams, Power Automate portal) all interface with this underlying service.

Adaptive Cards in Email¶

Adaptive Cards are a versatile UI component that can be embedded in various host applications, including email clients via Outlook Actionable Messages. They allow for rich, interactive experiences directly within the email body. When an action button on an Adaptive Card is clicked, it typically triggers an HTTP POST request to a specified endpoint, often an API associated with the service hosting the card data (in this case, Power Automate/Dataverse approval service). This mechanism allows the user’s action to be processed without leaving the email.

Guest Users in Microsoft 365/Azure AD B2B¶

Guest users are external users invited into an organization’s Azure Active Directory (AAD) tenant using Azure AD B2B collaboration. They are assigned a guest account in the resource tenant. While B2B collaboration aims to provide seamless access to shared resources, guest user accounts often have different default permissions and licensing considerations compared to member users. Access to specific applications, data, or APIs might be restricted by tenant configurations, conditional access policies, or application-specific permission models.

Why Might This Happen? Hypothesizing Causes¶

The HTTP 403 error points directly to a permission or authentication problem. Several factors, potentially interacting with each other, could contribute to guest users failing to approve via email Adaptive Cards:

1. API Endpoint Authorization: The specific API endpoint that the Adaptive Card in the email attempts to call when an action button is clicked might have stricter authorization checks for external identities compared to internal ones. Even if the guest user has permissions to respond to the approval request via other interfaces (like the Power Automate portal), the method of authentication or authorization used by the Actionable Message framework in the email might not be correctly translating or elevating the guest user’s permissions for that specific API call.
2. Tenant Configuration: Azure AD B2B settings or tenant-wide security configurations might implicitly or explicitly restrict certain types of cross-boundary API calls or interactions initiated from outside the core tenant network or standard application interfaces. While designed for collaboration, some advanced or embedded interactions might be unintentionally or intentionally blocked for guest accounts as a security measure.
3. Licensing: Although less commonly the cause of a 403 error (licensing issues often manifest differently), certain Power Automate or Dataverse functionalities might require specific licensing that isn’t universally applied or correctly recognized for guest user accounts in the context of this specific interaction method.
4. Actionable Messages Configuration/Trust: The Actionable Messages feature in Outlook relies on trust between the sending service (Power Automate) and the recipient’s email client/tenant. While typically configured out-of-the-box for standard scenarios, edge cases involving guest users across different tenant configurations might hit compatibility or trust boundaries that prevent the action from being authorized.
5. Dataverse Permissions: While the approval task is assigned to the guest user, the underlying Dataverse table storing the approval might have specific security roles or permission configurations that, while allowing viewing the request, restrict the ‘Update’ or ‘Perform Action’ capability when accessed via the specific API invoked by the Adaptive Card.

It’s important to note that while guest users might face this specific issue with the email Adaptive Card, they can typically still respond to the approval request through alternative methods, which reinforces the idea that the issue is specific to the interaction method rather than a fundamental lack of permission to approve at all.

Workarounds and Alternative Methods¶

While the original source material indicates the existence of a specific workaround, the details of that particular solution are not provided here. However, the most common and reliable approach to mitigate this issue when encountered is to guide guest users towards alternative interfaces for managing their approval tasks. These methods bypass the problematic email Adaptive Card interaction and allow guest users to successfully respond to requests.

The primary alternative methods that have proven effective for guest users are:

Responding via the Power Automate Portal¶

Every approval request assigned to a user, including guest users, is accessible through the Power Automate portal. This is the central hub for managing all flow-related tasks.

How to use this method:

1. Instruct the guest user to navigate to the Power Automate website (make.powerautomate.com).
2. They may need to sign in using their guest account credentials for your organization’s tenant. They should ensure they are in the correct environment where the approval process is running. The environment selector is usually in the top-right corner of the Power Automate portal.
3. In the left-hand navigation pane, they should select Approvals.
4. Under the Received tab, they will see a list of all approval requests assigned to them.
5. Clicking on a specific approval request will open a detailed view, allowing them to review the request details and find the Approve and Reject buttons, which are fully functional within the portal interface.

Responding via the Power Automate portal is a robust workaround as it uses the standard web interface, which generally has fewer permission boundary issues for invited guest users compared to embedded email actions.

Responding via Microsoft Teams¶

Microsoft Teams also offers a built-in Approvals app that aggregates approval requests. If the guest user has access to Teams within your organization’s tenant (which requires a Teams license assigned in their home tenant or your tenant, depending on the configuration, and appropriate B2B settings), they can often manage approvals there.

How to use this method:

1. Instruct the guest user to open Microsoft Teams. They may need to switch to your organization’s tenant using the tenant switcher next to their profile picture if they use Teams in their home tenant.
2. In Teams, they can search for the Approvals app. It might already be pinned or they may need to find it by clicking the ... (More added apps) button and searching for “Approvals”.
3. Opening the Approvals app will display requests sent to them under the Received section.
4. Clicking on a request in the Teams app provides an interface similar to the Power Automate portal, allowing them to review details and select Approve or Reject.

The Teams Approvals app, like the Power Automate portal, relies on standard API calls that are typically well-supported for guest users who have appropriate access to Teams and the underlying services.

These alternative methods, while requiring the user to leave their email client, successfully bypass the specific technical hurdle encountered with the email Adaptive Card, allowing guest users to participate effectively in approval processes.

Troubleshooting Steps and Considerations¶

Beyond guiding users to alternative methods, organizations can investigate several areas if this issue is persistent or widespread among guest users:

1. Verify Guest User Status: Ensure the guest user’s invitation was accepted and their account is in a fully active state within your Azure AD tenant. Confirm they can access other resources they are expected to.
2. Check Azure AD B2B Settings: Review your Azure AD External Identities settings in the Azure portal. Ensure there are no overly restrictive policies that might block guest users from accessing specific applications or APIs relevant to Power Automate or Dataverse. Consider settings related to guest user permissions and external collaboration settings.
3. Examine Power Automate Environment Permissions: Verify that guest users have appropriate security roles assigned within the Power Platform environment where the approval flow runs. While the approval task is assigned at the user level, environment-level permissions can sometimes influence the ability to interact with underlying dataverse records via certain interfaces. The default Basic User role is usually sufficient for responding to assigned approvals, but it’s worth confirming.
4. Review Flow Configuration: Although less likely to cause a 403 specific to the email card for guest users only, double-check the approval action configuration in the flow. Ensure the ‘Assigned To’ field correctly references the guest user and that the flow itself isn’t encountering other errors that might indirectly affect the approval step’s behavior.
5. Consider Email Client/Browser: While the issue is server-side (403), sometimes outdated email clients or browser extensions can interfere with how Actionable Messages are rendered or how the embedded actions are processed. Asking the guest user to try a different email client (e.g., Outlook Web Access vs. desktop client) or ensuring their client is updated might be worth a brief test, though this is less probable than a permission issue.
6. Check Actionable Messages Configuration: For on-premises Exchange or specific hybrid setups, ensuring that Actionable Messages are correctly configured and allowed might be relevant, though this specific error is more indicative of a permission issue after the message is received and the action is attempted.
7. When to Contact Microsoft Support: If the issue persists for multiple guest users across different flows and environments, and the alternative methods work reliably, it strongly suggests a specific interaction bug or configuration incompatibility related to guest users and Actionable Messages calling the Power Automate endpoint. In such cases, opening a support ticket with Microsoft provides access to deeper diagnostic tools and potential backend solutions.

Conclusion¶

The inability of guest users to approve or reject Power Automate requests directly from the email Adaptive Card, resulting in an HTTP 403 Forbidden error, is a frustrating but not uncommon issue. It highlights the complexities that can arise when integrating external identities with internal systems and features like Actionable Messages that rely on seamless API interactions.

While a specific technical workaround resolving the root cause of the email card failure for guest users might exist, the most practical and widely applicable solution currently available involves guiding guest users to utilize the alternative approval interfaces provided by the Power Automate portal and the Microsoft Teams Approvals app. These platforms offer full functionality for guest users with appropriate permissions and serve as reliable methods for ensuring external collaborators can effectively participate in your automated approval workflows. By understanding the symptoms and communicating these alternative methods, organizations can maintain efficient collaboration processes even when encountering this specific limitation.

Have you encountered this issue with guest users and Power Automate approvals? Do you have other workarounds or insights to share? Please leave a comment below and share your experiences.