[CoE Starter Kit - QUESTION] QUESTION

[RPI-hash]

Does this question already exist in our backlog?

• I have checked and confirm this is a new question.

What is your question?

Sync template V4 flow and at grant role flow is failing continuously. Error to check the role

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.50.6 October

What app or flow are you having the issue with?

Admin-sync template V4 driver

What method are you using to get inventory and telemetry?

Cloud flows

[AmarSaiRam]

Hi @RPI-hash

Root Cause:

In Microsoft 365 Copilot system environments, Microsoft intentionally blocks certain powerful admin actions ("ManageAnyCustomApi" for custom connectors) for security reasons. This is enforced by design, using the "PermissionBlockedByOfficeAI" error code. Custom connectors cannot be managed by admins in these special environments since they are tightly restricted for Copilot/AI plugin scenarios. This is not a bug in the CoE Starter Kit, but rather a platform-imposed security feature.

Troubleshooting & Workaround:

Do not expect full admin rights:
In environments flagged as Copilot system environments, admin actions such as managing custom connectors will be intentionally blocked. This flow will keep failing if it hits these permissions checks.

Error Handling Solution:
The Microsoft team and CoE Starter Kit contributors suggest adding a custom error-handling scope in the Admin | Sync Template v4 (Custom Connectors) flow. If the error message contains "PermissionBlockedByOfficeAI," the flow should be set to terminate with "success" instead of "failure."
This logic is expected to be implemented in an upcoming release (after November 2025), but you can manually implement it in your current flow version by:

Editing the flow.
Adding a scope or condition in the error handling steps.
Checking if the error message contains "PermissionBlockedByOfficeAI."
If so, terminate the flow as "succeeded" to avoid alerting or failing the run.
Do not use Copilot Environments for unsupported workloads:
If your CoE inventory/sync flows must interact with all permissions/objects, ensure you are not targeting these restricted Copilot system environments. Run the flows only in standard (non-Copilot) environments when possible.

Additional Verification Steps
1.Check your service account permissions:
Ensure the service account has System Administrator role in the CoE environment
Verify it has Power Platform Administrator role in the tenant

2.Verify Connection References:
In the CoE environment, go to Solutions → Center of Excellence - Core Components
Check all connection references are properly configured
Specifically verify the Power Platform for Admins V2 connector

3.Check for Microsoft 365 Environment:
In the Power Platform Admin Center, look for environments with names like "Microsoft 365"
These are auto-created Copilot environments that may cause the permission issues

[AmarSaiRam]

Dear User,

We noticed that this issue has been pending for quite some time, and we have not received any recent updates from your end. In the absence of further communication, we are proceeding to close this ticket, assuming that your concerns have been addressed or resolved.
If you continue to experience any difficulties related to this matter, please feel free to open a new support ticket. This will help us ensure prompt and effective assistance, rather than reopening the new Issue.
Thank you for your understanding and cooperation.

Best Regards,
CoE Starter Kit Team