← Al Davies, 250 High Street

Power Automate 403 Forbidden on a SharePoint action: what to check

Short answer: a 403 Forbidden means the flow reached SharePoint and was refused. Microsoft's table says it means "You don't have permission to access the resource, or a DLP policy is blocking the connector." Start with the account behind the connection, not the person who built the flow.

403 is not 401

Microsoft's table lists both. A 401 Unauthorized means the connection token expired or the password changed, and the fix is to re-authenticate. A 403 means you lack permission on the resource, or a DLP policy is blocking the connector. Our advice, not a Microsoft rule: reconnecting alone may not fix a 403. For the 401 case, see "Power Automate 401 Unauthorized".

Check 1. Who owns the connection

  1. Open the failed run and select the failed action.
  2. Look at the connection name under the action. Note the account.
  3. Open https://make.powerautomate.com and select Connections in the left navigation.
  4. Find the same connection. Confirm which account signed in.

If the connection belongs to someone else, Microsoft gives two fixes: that person signs in again, or you create your own connection and point the flow at it. Our advice, not a Microsoft rule: check permissions for this account, because it is the account SharePoint sees.

Check 2. Site permissions on the target

Microsoft's SharePoint table lists: "Site permissions changed. 403 on actions targeting a specific site. Verify your account has at least Contribute access to the site."

  1. Open the target SharePoint site in a browser, signed in as the connection account.
  2. Open the target list or library.
  3. Try the same thing the flow does, such as add an item.

If the connection account cannot do it in the browser, the flow cannot either. Ask the site owner to grant access. See "SharePoint access denied".

The same Microsoft table lists: "Admin consent required. 403 on first use or after policy change. Admin must grant consent in Microsoft Entra ID > Enterprise Applications > Power Automate." This is an admin step. Ask your admin.

Check 4. DLP policy

Microsoft's page says: "If permissions are correct, ask your admin if a DLP policy was recently changed." It adds: "DLP policy changes take effect immediately and can block flows without warning."

To look for it:

  1. Open the flow details page.
  2. Select Properties.
  3. Look for a DLP violation message.

Contact your Power Platform admin. They can tell you which policy changed and which connectors it affects. See "Power Automate flow turned off automatically".

Microsoft's SharePoint and Power Automate page says that if Conditional Access policies target individual apps with different requirements, "users see an authentication error when they try to access flows from SharePoint." It advises targeting the Office 365 app or All cloud apps. This is an admin setting. Ask your admin.

Other places a 403 shows up

Microsoft's table for Outlook lists "403 when sending from or reading a shared mailbox," with the fix that the connection owner needs Send As or Full Access permission on the shared mailbox in Exchange Admin Center. For Dataverse it lists 403 when your user lacks a security role. This guide covers SharePoint only.

What to avoid

Who to call

Call your SharePoint site owner for Check 2. Call your Power Platform admin for Checks 3 and 4, and for Conditional Access.

When to get help

You can build all of this yourself in Microsoft 365. If you would rather have it built and tested for your team, I do that. A tracker like this is a fixed price: $5,000 for one, built in 2 weeks. See "What a SharePoint tracker costs to build". Bring one example of the problem to a free call.

Tell me what's still manual

I am Al Davies. I run 250 High Street LLC and build SharePoint trackers and Power Automate flows for operations teams. I work remotely. The first call is free, and I will not try to sell you anything.

See trackers I built: Tools I built

FAQ

What does a 403 Forbidden mean in Power Automate?

Microsoft says you lack permission on the resource, or a DLP policy is blocking the connector.

How do I fix 403 Forbidden on a SharePoint action in Power Automate?

Check the connection account has at least Contribute access to the site, then ask your admin about consent and DLP.

What is the difference between 401 and 403 in Power Automate?

A 401 means the token expired or the password changed. A 403 means access to that resource is refused.

Why did several of my flows start returning 403 at the same time?

Microsoft says DLP policy changes take effect immediately and can block flows without warning, so ask your admin.

Where do I fix a broken connection in Power Automate?

Select Connections in the left navigation, open the three dots menu on the connection, and select Fix connection or Edit.

Sources