Help with agents and workflow/dataverse access

Question

Help with agents and workflow/dataverse access

Neil Patel 0

I was hoping you can help us with something. We are using Copilot Studio. We've built an agent to test things out and a workflow that adds a row to dataverse that it has access to. The workflow is triggered by the agent via a tool, and the agent uses it to add a new row to a database table.

If I'm in the workflow itself and I manually run that node, it works and a row gets added. So the workflow has the right level of access through the connection that we've got, but whenever the agent tries to call the workflow (as a tool), it's met with a 401 unauthorised error.

I've had a look at the help documentation and everything, but I'm not sure if we're missing something around permissions for the agent or if there's a reason that authentication is not carrying through.

Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-08-31T09:53:48.7566667+00:00
Hi Neil,

A successful manual node test confirms the Dataverse connection works for the maker, but it doesn’t confirm that the agent can invoke the workflow with the same runtime identity.

Please check the following:

Confirm the workflow uses “When an agent calls the flow,” includes “Respond to the agent,” and is published.

In the agent, open Settings > Connection Settings and verify the connection is Connected, not expired or stale. Reauthenticate it if necessary.

Check the tool’s authentication mode:

Use Agent author authentication if every invocation should use the maker/service connection.

Use User authentication if each user should access Dataverse with their own identity. The agent must require authentication, and that user needs Create permission on the Dataverse table.

For a solution-aware workflow, verify its Dataverse connection reference points to a valid connection in the same environment.

Save and publish the workflow and agent again, then retry.

Also review the workflow run history:

If no run is created, the 401 is occurring between the agent and workflow. Reconnect or remove and re-add the workflow tool.

If a run is created and the Dataverse action returns 401, repair the Dataverse connection/reference and verify the runtime identity’s security role.

Manual testing and agent invocation use different authentication contexts, so this is normally a configuration issue rather than a product bug. If it still fails with a valid connection and controlled permissions, please capture the agent activity trace, workflow run ID, failing action output, environment ID, authentication mode, and timestamp for support investigation.

References:

https://learn.microsoft.com/en-us/microsoft-copilot-studio/configure-enduser-authentication https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-connections

https://learn.microsoft.com/en-us/power-apps/maker/data-platform/create-connection-reference

1 answer

Your answer

Answer 1

start time: 8/31/2026, 2:02:37 PM (UTC)

run id: 08584134219278938452966926551CU09

workflow id: 76b2091b-6d29-42af-5c59-149e9fb87f7d
{

"Set-Cookie": "ARRAffinity=4973511b512b5fdc2f9ac8d2c215d43533ecadaf34ee9ef318025767afcf3a5aeb29bb4b19df1459d2ea781b605f33064b9fea1f144b525b9d7676625c4ffb5408DF076CB48ACD2F0000001458522986; path=/; secure; HttpOnly,ReqClientId=72839255-afd0-46f8-9fd6-4007937442ab; expires=Mon, 31-Aug-2076 14:02:37 GMT; path=/; secure; HttpOnly,ARRAffinity=4973511b512b5fdc2f9ac8d2c215d43533ecadaf34ee9ef318025767afcf3a5aeb29bb4b19df1459d2ea781b605f33064b9fea1f144b525b9d7676625c4ffb5408DF076CB48ACD2F0000001458522986; path=/; secure; HttpOnly",

"WWW-Authenticate": "Bearer authorization_uri=https://login.microsoftonline.com/7178fbe1-c732-45ed-8079-99965c54a0a0/oauth2/authorize, resource_id=https://orgc164e156.crm17.dynamics.com/",

"x-ms-service-request-id": "6bf61b91-5d3d-4749-bfd7-c87ed8671604",

"Strict-Transport-Security": "max-age=31536000; includeSubDomains",

"REQ_ID": "6bf61b91-5d3d-4749-bfd7-c87ed8671604",

"AuthActivityId": "755efb09-9949-495c-ba4f-8c93742b4b71",

"401_Error_Reason": "Authorization header value format is incorrect (Expected Format:Bearer access_token).",

"NativeWebSession-Version": "2",

"X-Source": "22551601991456222720010761219432062008618934180183621222137146121901351432042431,194196226155721256019913016824018219212421914320437118145483230183921914310187153215230",

"Public": "OPTIONS,GET,HEAD,POST",

"Date": "Mon, 31 Aug 2026 14:02:41 GMT",

"Allow": "OPTIONS,GET,HEAD,POST",

"Content-Type": "text/html; charset=utf-8",

"Content-Length": "0"

}

Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-09-10T05:08:50.67+00:00

Thanks — the run details are helpful. The 401 response appears to point to an authentication/header issue rather than a straightforward Dataverse table permission issue.

The key error is:

401_Error_Reason: Authorization header value format is incorrect (Expected Format:Bearer access_token).

Since we have a workflow run ID (08584134219278938452966926551CU09), could you please check the specific Dataverse action in that run and confirm whether the 401 is being returned by the Dataverse connector/action itself?

I would also verify:

Which Dataverse connection/connection reference the action is using at runtime.

Whether that connection is still valid and can be reauthenticated.

Whether the agent tool is configured for Agent author authentication or User authentication.

If User authentication is being used, whether the agent is correctly requiring authentication and passing the expected user context.

Whether removing/re-adding the workflow as an agent tool and republishing both the workflow and agent changes the behavior.

The manual test succeeding seems to confirm that the maker's Dataverse connection has access, but the agent invocation may be using a different authentication context.

If the Dataverse action is the point where the 401 occurs, the next useful information would be the action name and its connector/connection-reference configuration (without sharing any access tokens or other secrets).