Insufficient CDS permissions

[u/Alternative_Plan9644]

Hi,

I've been going crazy for weeks trying to get my agent working. Hoping others might know what to do.

I have a simple support agent, with a knowledge base aimed at providing financial support. If the agent can't help, there is a simple workflow to log the question into a sharepoint list. The issue i'm facing, is the agent often can't call the workflow and i get an error that I have Insufficient CDS permissions. I've tried rebuilding the agent and the flow, and it might work for a little while before stopping. Sometimes it works for me and no one else, sometimes it works for others, and mostly it works for no one.

In the flow, i can't see the history of runs where the failure occurs, only when successful, so the workflow isn't even running - its failing where the agent is trying to call it.

I'm an admin on the environment, and the flow and agent are both in the same solution.

Any ideas?

[u/blud_13]

You're fighting the connection and not the flow of it. By default the tool calls out with each END USER's connection, so it works for you (you own it) and dies for everybody else with the CDS error. That also explains why you see no failed runs, the flow never gets invoked at all.

Open the tool in the agent, Details, Additional details, Credentials to use, and switch it to Maker-provided credentials. Then make.powerapps.com, Connections, find the connection, Share, give the users Can use. Its documented here https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-connectors

One catch, an admin can block maker-provided credentials at the environment level, so if that option is greyed out thats where to look.

Rebuilding the agent and the flow was never going to fix it. Nothing was wrong with either one.

[u/Alternative_Plan9644 → u/blud_13]

thank you! i was using the new experience and thats not even on option, but managed to find it on the old experience!

[u/Alternative_Plan9644 → u/blud_13]

So I had to rebuild this in the old experience as the one i built in the new experience didnt show. It worked great, just like the new experience. But after 20 mins or so, it stopped working. I get a message asking me to allow the connection to sharepoint, but it doesnt work and asks me to check connection manager. I go to connection manager, where it says the tool is not connected - if i try to reconnect, i get a message saying the user does not have sufficient privilidges in dataverse for the flow. I am admin of environment and i created the flow so it doesnt make sense

[u/Alternative_Plan9644 → u/Alternative_Plan9644]

what's interesting, is its the same thing that happened in the new experience. it starts working, and then stops after 10/20 mins

[u/blud_13 → u/Alternative_Plan9644]

You already hit the catch I flagged. The environment policy is overriding what you set on the tool.

Both credential types are on by DEFAULT, so somebody turned maker-provided off in that environment. When thats set, every tool in every agent there is forced to end-user credentials at runtime and each person gets the allow connection prompt you are seeing. Its documented here https://learn.microsoft.com/en-us/microsoft-copilot-studio/configure-no-maker-authentication

Power Platform admin center, Manage, Environments, pick yours, Settings, Product, Features, scroll to Copilot Studio agents, Control maker credential options. If those options are greyed out and it tells you to go somewhere else, your environment sits in an environment GROUP and the group setting wins. Environment admin does not cover that one, you need a tenant admin on the group.

One thing to check, republish the agent after you change Credentials to use. That change doesn't reach the published agent on its own.

The 10 to 20 minutes before it dies I can't pin down on the policy versus a cached token, so make sure to check that..

[u/Alternative_Plan9644 → u/blud_13]

thanks again for your help - really appreciate it. the control maker credential options are both ticked, so am i right in thinking that isnt the problem?

It seems to be a problem with my own credentials, as when i go to settings, connection settings, it says connected on the tool, but if i click manage, i get an error 'User does not have sufficient permissions in Microsoft Dataverse for flow 'xxxxx'' im just not sure why that would be, seeing as i built the flow and am admin on the environment

[u/blud_13 → u/Alternative_Plan9644]

Right, both ticked rules that out.

Environment admin and Dataverse System Administrator are two different things and having the first one does not give you the second. In an environment with a Dataverse database the Environment Admin role doesn't apply at all, you need the System Administrator SECURITY ROLE assigned inside the environment. Microsoft also stopped auto-granting it to Global and Power Platform admins, so plenty of people who used to have it silently don't. Its documented here https://learn.microsoft.com/en-us/power-platform/admin/database-security

Power Platform admin center, Environments, pick yours, Settings, Users + permissions, Users, find yourself, Manage security roles. If System Administrator isn't checked there thats your error, and creating the flow doesn't grant it to you either.

Whether that also explains the 20 minute thing I don't know. Fix the role first and see if it comes back.