Power Automate - Custom Connector Issues

Kieran Hale 0 Reputation points
2026-08-18T14:08:38.8833333+00:00

Hi there,

I've been trying to set up a custom connector within PowerAutomate for a while now to aid in creating Planners and other SharePoint admin tasks when we create new sites. 

I'm having issues getting the custom connector to authenticate itself using the App Registration I've set up. 

I've deleted and recreated the connector a few times now, with little success. 

Security has been set up using OAuth 2.0, Azure Active Directory for the identity provider. 

Client ID - Application (client) ID from my App registration. 

Client secret - taken from the App registration again.

Authorization URL - https://login.microsoftonline.com/common/oauth2/v2.0/authorize

Tenant ID - Common, also tired using our Tenant ID

Resource URL - https://graph.microsoft.com

Scope - left as blank.

When I try to test the connector, I keep getting the error below - I've watched countless videos now on trying to set this up correctly but I was wonder if anyone could point me in the correct direction to set this up or even if I'm just missing something simple.

I'm working from a development environment within my organisation at present, once these items are working they'll be exported as a solution and published for everyone to use. 

{   "client-request-id": "eaba0cc5-f5c9-44ac-9b58-acfd6f809006",   "content-encoding": "gzip",   "content-type": "application/json",   "date": "Tue, 18 Aug 2026 13:49:24 GMT",   "request-id": "eaba0cc5-f5c9-44ac-9b58-acfd6f809006",   "strict-transport-security": "max-age=31536000",   "vary": "Accept-Encoding",   "www-authenticate": "Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000"",   "x-ms-ags-diagnostic": "{"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"5","ScaleUnit":"006","RoleInstance":"LN2PEPF00013E06"}}",   "x-ms-apihub-cached-response": "true",   "x-ms-apihub-obo": "false",   "x-ms-au-caller-id": "dee7aa0b-2e63-4007-84fe-2981309f7fc6",   "x-ms-au-creator-id": "dee7aa0b-2e63-4007-84fe-2981309f7fc6",   "x-ms-dlp-ef": "-|-/-|-|-|-|-",   "x-ms-dlp-gu": "-|-",   "x-ms-dlp-re": "-|-|-",   "x-ms-environment-id": "29559958-cb9b-eb4a-9fb1-403d61e1f6a4",   "x-ms-mip-sl": "-|-|-|-",   "x-ms-tenant-id": "2cb4a02b-4270-43ab-96bc-ec7227171d45" }

{   "error": {     "code": "InvalidAuthenticationToken",     "message": "Access token is empty.",     "innerError": {       "date": "2026-08-18T13:49:25",       "request-id": "eaba0cc5-f5c9-44ac-9b58-acfd6f809006",       "client-request-id": "eaba0cc5-f5c9-44ac-9b58-acfd6f809006"     }   } }

I've also tried to sign in using the Swagger editor and get a redirector error saying "blob:///oauth2-redirect.html".

Microsoft Security | Microsoft Graph
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-08-18T14:08:59.2866667+00:00

    The failure is consistent with an incomplete or incorrect OAuth configuration for the custom connector. The key issues in the current setup are:

    1. Scope is blank Missing or incorrect scopes are a documented cause of custom connector authentication failures. If refresh tokens are needed, include offline_access.
    2. OAuth settings must be validated end-to-end outside Power Automate Before configuring the custom connector, verify the OAuth flow in Postman:
      1. Call the token endpoint.
      2. Call the API by using the returned token.
      3. Refresh the token after expiry.
      4. Call the API again with the refreshed token.
    3. Custom connectors use the authorization code flow Implicit and client credentials flows do not issue refresh tokens and aren’t suitable for user-delegated authentication in custom connectors.
    4. Check for mismatched or incomplete OAuth values Common causes called out in the documentation are:
      • incorrect authorization or token endpoint
      • mismatched redirect URI between the app registration and the custom connector
      • missing or incorrect scopes
      • mixing v1.0 and v2.0 endpoints or parameters
      • app registration not set up for the intended tenant or multitenant scenario

    Use this validation path:

    1. In the app registration, note these values:
      • Directory (tenant) ID
      • Application (client) ID
      • Authorization endpoint: /oauth2/v2.0/authorize
      • Token endpoint: /oauth2/v2.0/token
      • required delegated scopes
    2. Add this redirect URI temporarily for Postman testing:
      • https://oauth.pstmn.io/v1/callback
    3. In Postman, test OAuth 2.0 with the app registration values and confirm:
      • token issuance succeeds
      • the API accepts the bearer token
      • token refresh succeeds
    4. In the custom connector, recheck:
      • Identity provider is Microsoft Entra ID
      • redirect URI in the app registration exactly matches the custom connector redirect URI
      • scopes are populated correctly instead of left blank
      • endpoint versioning is consistent and not mixed
    5. If testing in the connector still fails, create a new connection and test it from the connector’s Test tab. For some connectors, later steps fail unless a new connection is created and tested first.

    About the Swagger editor redirect error: the returned guidance only supports checking OAuth configuration, redirect URIs, scopes, and endpoint consistency. The supported next step is to verify the same OAuth flow outside Power Automate first, then bring the exact working values back into the connector.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.