Fix 401 Unauthorized in Power Automate

Short answer: a 401 Unauthorized error in Power Automate means the flow could not prove who it is. Microsoft's table says: "Your connection token expired, or your password changed." Open the failed run, read the error code, fix the connection, and choose Resubmit. If the code is 403 instead, the sign-in is fine and the account lacks access, so you fix permissions on the site. The steps below show how to tell the two apart.

What 401 means and what 403 means

Two codes get mixed up. Microsoft's table on connection failures gives these meanings:

401 Unauthorized: "Your connection token expired, or your password changed."
403 Forbidden: "You don't have permission to access the resource, or a DLP policy is blocking the connector."
404 Not Found: "The resource was deleted, renamed, or moved."

Microsoft's page on troubleshooting a cloud flow says: "In many cases, flows fail because of an authentication error. If you have this type of error, the error message contains Unauthorized or an error code of 401 or 403 appears."

So 401 is a sign-in problem. 403 is an access problem. The fix for each is different, and fixing the wrong one wastes time.

Signs you have this problem

The latest run shows Failed and a red step.
The error text says Unauthorized or shows 401.
The flow ran well for weeks and then stopped.
A person changed a password, or your company turned on a new sign-in rule, just before the first failure.
The flow works when you start it yourself but fails when it runs on its own.

Step 1. Open the failed run

In the flow's run history, open the run marked Failed; the red step holds the code. The 28-day run history is covered in "Flow fails because the connection expired: how to fix it". Use it to read the error code, then come back here.

Step 2. Note the code and the step

Record the code (401 or 403) and which step failed. The step tells you where to look. A SharePoint step points to one site, and an email step points to one mailbox, so the failed step decides which account and place you check in Step 4.

A 404 is a different case: the list, file or mailbox the flow points to has changed, so edit the step to point to the new place. This guide covers 401 and 403 only.

Step 3. Fix the connection for a 401

A connection is the saved sign-in a flow uses to reach an app. Microsoft names several reasons one stops working, including "You changed your password, or your organization enforces periodic password rotation. The stored OAuth token is now invalid." and "OAuth refresh tokens expire after approximately 90 days of inactivity."

For a 401, the short version is: in the failed step's error pane, choose View Connections, click Fix connection beside the one showing Unauthorized, sign in again, then go back to the failed run and choose Resubmit. Microsoft then says: "The flow should now run as expected." If the connection is owned by a coworker, Microsoft says that person must sign in again, or you can create your own connection and point the flow at it.

The full walkthrough, with the reasons connections expire and how to find every flow that uses one, is in "Flow fails because the connection expired: how to fix it".

Step 4. Check site access for a 403

Microsoft's SharePoint table lists this case: "Site permissions changed", with the symptom "403 on actions targeting a specific site". The fix it gives is: "Verify your account has at least Contribute access to the site".

One way to start:

Find out which account the failed step uses. Open the flow in edit mode and look at the connection on the step.
Open the SharePoint site the step points to, for example https://yourcompany.sharepoint.com/sites/YourSite, signed in as that same account.
If the site will not open, or you cannot add or change items, ask the site owner to give that account access.
Run the flow again with Resubmit.

Our advice, not a Microsoft rule: when a flow keeps failing because one person's access changes, ask your admin whether a work account for flows is allowed at your company. Do not share one person's personal login.

Microsoft also says a 403 can come from a data loss prevention (DLP) policy: "Your admin might have updated a Data Loss Prevention (DLP) policy." If several flows broke on the same day and you changed nothing, tell your Power Platform admin. This is an admin task.

Step 5. Check Conditional Access if it only fails inside SharePoint or Teams

Microsoft describes one more case. Its page says: "If your flow works from the Power Automate portal but fails with an authentication error when users access it from SharePoint, Microsoft Teams, or Excel, the issue might be a Conditional Access (CA) policy mismatch."

Microsoft also says that if a policy includes a Terms of Use grant control, "existing flow connections can break retroactively because the silent token refresh can't present the Terms of Use acceptance page." Changing these policies is an admin task. Pass the Microsoft page in the sources to your admin and let them decide.

Step 6. Resubmit, then add a failure alert

Resubmitting the failed run, watching the next scheduled run for green checks and adding a failure alert are covered in the connection-expired guide.

What to avoid

Resubmitting before the sign-in is repaired. The same 401 comes straight back.
Signing in again and again on a 403. A fresh sign-in cannot grant site access.
Borrowing a coworker's password to get past the error.
Editing security rules on your own. Send those to your admin.
Sending failure alerts to one person's inbox. If that person is away, nobody sees them, so use a shared place. For what happens when an owner leaves, see "The person who built your flows left: what happens and what to do".
Assuming the flow is still on. See "Why Power Automate turned your flow off, and how to turn it back on".

Honest limits

This guide covers cloud flows that use the SharePoint connection. Your company may have sign-in, Conditional Access or DLP rules that change what you see. Screen names change over time. Confirm each step against the Microsoft pages in the sources. I cannot see inside your tenant from here.

When to get help

You can build all of this yourself in Microsoft 365. If you would rather have it built and tested for your team, I do that. A tracker like this is a fixed price: $5,000 for one, built in 2 weeks. See "What a SharePoint tracker costs to build". Bring one example of the problem to a free call.

Tell me what's still manual

I am Al Davies. I run 250 High Street LLC and build SharePoint trackers and Power Automate flows for operations teams. I work remotely. The first call is free, and I will not try to sell you anything.

See trackers I built: Tools I built

FAQ

What is the difference between 401 and 403 in Power Automate?

Microsoft's table says 401 Unauthorized means "Your connection token expired, or your password changed." It says 403 Forbidden means "You don't have permission to access the resource, or a DLP policy is blocking the connector." Fix the connection for 401. Check access for 403.

Will Resubmit work after I fix the connection?

Microsoft lists Resubmit as the last step of its authentication fix and says: "The flow should now run as expected." Check the new run for green checks.

The connection belongs to a coworker. What now?

Microsoft says that person needs to re-authenticate, or you can create your own connection and update the flow to use it.

How much access does the account need on a SharePoint site?

For a 403 on a specific site, Microsoft's fix is "Verify your account has at least Contribute access to the site". The level a given step needs can be higher. Ask your site owner.

Can I stop 401 errors from coming back?

Microsoft says "Service principal connections don't rely on a user's OAuth token. They don't expire when someone changes their password or leaves the organization." It advises you to ask your admin about them for key connectors. Whether that fits your company is your admin's call.