'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Power Automate Conditional Access Token Issuance Errors
Question details
Users need to resolve a flow run failure where Microsoft Entra Conditional Access blocks the issuance of tokens for a Power Automate flow triggered by Power Apps.
- Product
- Microsoft Power Automate
- Device & OS
- not provided
- Scenario
- Running a Power Automate flow triggered by a Power Apps form within an environment secured by enterprise access policies.
- Observed behavior
- The flow run fails with an error indicating that the connection used by the flow does not satisfy an applicable access policy, and access is blocked by a Conditional Access Policy preventing token issuance.
Before modifying security rules, ensure you have appropriate administrator privileges (such as Conditional Access Administrator) in the Microsoft Entra ID portal to view sign-in logs and edit policies.
Review and Adjust Microsoft Entra Conditional Access Policies
Identify the specific policy blocking the connection and adjust its conditions or exclusions to allow token issuance for your flow.
Conditional Access policies in Microsoft Entra evaluate signals like user location, device compliance, and IP address. If the Power Automate connection doesn't meet these requirements during execution, token issuance is blocked.
Sign in to the Microsoft Entra admin center. Navigate to Identity > Monitoring & health > Sign-in logs. Filter by the affected user or service principal to find the exact Conditional Access policy resulting in a 'Failure'.
Go to Protection > Conditional Access > Policies. Select the specific policy identified in the sign-in logs.
Review the assignments. If appropriate for your organization's security posture, exclude the specific user account, service principal, or trusted IP range from the policy, then save the changes.
Fulfill Multifactor and Device Compliance Requirements
Ensure that the user and device triggering the flow meet the strict prerequisites enforced by the organization's Conditional Access rules.
Consult the Power Platform Community
Seek specialized assistance from Microsoft specialists if the token issuance issue persists despite correct policy configuration.
Simplify Your Document Workflow with WPS Office
Enterprise policies like Conditional Access can sometimes make automated Microsoft workflows complex to manage. For your daily document, spreadsheet, and presentation needs, WPS Office offers a powerful, lightweight, and hassle-free alternative without the heavy administrative overhead.
- 1. Download the Installer: Visit the official WPS Office website and download the free software suite.
- 2. Install and Launch: Follow the quick installation prompts. No complex enterprise authentication setup is required for basic local use.
- 3. Open Your Office Files: Directly open your existing .docx, .xlsx, and .pptx files and continue working seamlessly.
Frequently Asked Questions
What causes the 'issuance of tokens is blocked' error in Power Automate?
This error occurs when the connection used by a Power Automate flow violates a Microsoft Entra Conditional Access policy. The policy may be blocking access because the user is outside a trusted location, using a non-compliant device, or missing multifactor authentication.
How can I check which Conditional Access policy is blocking my flow?
You can identify the blocking policy by reviewing the Microsoft Entra Sign-in logs. Filter the logs by the user account or app triggering the flow, find the failed sign-in attempt, and view the 'Conditional Access' tab in the log details to see which policy failed.
Can I bypass Conditional Access policies directly within Power Automate?
No, Conditional Access policies are enforced at the identity level by Microsoft Entra ID. You cannot bypass them from within the Power Automate interface. An administrator must adjust the policy rules or add an exclusion for the specific scenario.
