Skip to content

Commit 3b92b14

Browse files
lucciz01lucciz01
authored
Merge pull request #8948 from MicrosoftDocs/sbm-s2s-get-access-token
AB#5912: Sbm s2s get access token
2 parents 2bf8c39 + 4d1a6ae commit 3b92b14

File tree

2 files changed

+211
-1
lines changed

2 files changed

+211
-1
lines changed

‎support/sales-copilot/crm-permissions-and-configurations/errors-when-accessing-salesforce-with-server-to-server-flow.md‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
---
2+
title: Errors When Accessing Salesforce with Server-to-Server Flow
3+
description: Troubleshoot and resolve errors that occur when accessing Salesforce with server-to-server flow or during setup in Microsoft Copilot for Sales.
4+
ms.date: 05/29/2025
5+
author: sbmjais
6+
ms.author: shjais
7+
ms.reviewer: marrabi
8+
ms.custom: sap:CRM Permissions and Configurations\CRM Settings
9+
---
10+
# Errors that occur when accessing Salesforce with server-to-server flow
11+
12+
This article helps you troubleshoot and resolve errors that might occur when a user tries to access Salesforce with a server-to-server flow or when an administrator sets up the server-to-server flow for Salesforce in Microsoft Copilot for Sales.
13+
14+
## Who is affected?
15+
16+
| Requirement type |Description |
17+
|---------|---------|
18+
|**Client app** | Copilot for Sales Outlook add-in |
19+
|**Platform** | Web and desktop clients |
20+
|**OS** | Windows and Mac |
21+
|**Deployment** | User managed and admin managed |
22+
|**CRM** | Salesforce |
23+
|**Users** | All users or administrators |
24+
25+
## Access denied for this user
26+
27+
### Symptoms
28+
29+
When a user tries to access Salesforce with the server-to-server flow, the following error message occurs:
30+
31+
> Access denied for this user.
32+
33+
You might also see the following message:
34+
35+
> User doesn't have admin permission to access the connected app.
36+
37+
### Cause
38+
39+
This error occurs when the integration user isn't approved to access the connected app in Salesforce. During the server-to-server flow setup, a connected app is deployed and associated with an integration user. If the integration user lacks the necessary permissions, access is denied.
40+
41+
### Resolution
42+
43+
To resolve this issue, update the connected app configuration in Salesforce:
44+
45+
1. Sign in to Salesforce CRM as an administrator.
46+
47+
1. Go to **Setup** > **Platform Tools** > **Apps** > **Connected Apps** > **Managed Connected Apps**.
48+
49+
1. On the **Connected Apps** page, select **Copilot for Sales Connected App**.
50+
51+
1. Under **Custom Connected App Handler**, ensure that the value of **Run As** is set to **Copilot for Sales Integration User**.
52+
53+
1. Go to **Administration** > **Users** > **Users** and confirm that the profile of the integration user is **CopilotForSalesIntegrationProfile**.
54+
55+
In addition, check if any unintended changes are made to the connected app configuration. If yes, revert the changes to the original configuration.
56+
57+
## Server-to-server authentication failed
58+
59+
### Symptoms
60+
61+
When a user tries to access Salesforce with the server-to-server flow, the following error message occurs:
62+
63+
> Server-to-server authentication failed.
64+
65+
You might also see one of the following messages:
66+
67+
- > Client credentials flow is disabled in Salesforce.
68+
- > Couldn't get access token for client credentials flow in Salesforce.
69+
70+
### Cause
71+
72+
This error occurs when the connected app or the integration user is misconfigured. During the server-to-server flow setup, a connected app is deployed to the Salesforce organization and associated with an integration user. An access token is retrieved using the credentials of the connected app. If the configuration is incorrect, authentication fails.
73+
74+
### Resolution
75+
76+
To resolve this issue, ensure that the connected app and integration user configuration are correct.
77+
78+
1. Sign in to Salesforce CRM as an administrator.
79+
80+
1. Go to **Setup** > **Platform Tools** > **Apps** > **App Manager**.
81+
82+
1. On **Copilot for Sales Connected App** row, select the down arrow, and then select **Edit**.
83+
84+
1. Under **API (Enable OAuth Settings)**, ensure that **Enable Client Credentials Flow** is selected.
85+
86+
1. Go to **Apps** > **Connected Apps** > **Managed Connected Apps**.
87+
88+
1. On the **Connected Apps** page, select **Copilot for Sales Connected App**.
89+
90+
1. Under **Custom Connected App Handler**, ensure that the value of **Run As** is set to **Copilot for Sales Integration User**.
91+
92+
1. Open user details for the **Copilot for Sales Integration User** user and confirm the following:
93+
94+
1. The profile of the integration user is **CopilotForSalesIntegrationProfile**.
95+
1. The user is associated with the **Copilot for Sales connected app permission set**.
96+
1. The user is associated with the **Salesforce API Integration** permission set license assignments.
97+
98+
In addition, check if any unintended changes are made to the connected app or integration user configuration. If yes, revert the changes to the original configuration.
99+
100+
## Server-to-server authorization failed
101+
102+
### Symptoms
103+
104+
When a user tries to access Salesforce with the server-to-server flow, the following error message occurs:
105+
106+
> Server-to-server authorization failed.
107+
108+
You might also see one of the following messages:
109+
110+
#### Error 1: Couldn't get client credentials to access Salesforce
111+
112+
##### Cause
113+
114+
During the Salesforce server-to-server flow setup, a connected app is deployed to the Salesforce organization. The connected app is associated with an integration user. An access token is retrieved with the client ID and the secret of the connected app. The error occurs when the secret is invalid.
115+
116+
##### Resolution
117+
118+
To resolve this issue, contact [Microsoft support](/microsoft-sales-copilot/get-support) and provide the following information:
119+
120+
- Whether the "Copilot for Sales Connected App" connected app is updated accidentally.
121+
- If the connected app is still available, provide its ID.
122+
123+
#### Error 2: Session ID isn't allowed for use REST API access at Salesforce
124+
125+
##### Cause
126+
127+
This error occurs if the appropriate OAuth scope isn't set for the connected app during the Salesforce server-to-server flow setup.
128+
129+
##### Resolution
130+
131+
To resolve this issue, contact your administrator to set the appropriate OAuth scope for the connected app and confirm that the connection is still active in admin settings.
132+
133+
1. Sign in to Salesforce CRM as an administrator.
134+
135+
1. Go to **Setup** > **Platform Tools** > **Apps** > **App Manager**.
136+
137+
1. On **Copilot for Sales Connected App** row, select the down arrow, and then select **Edit**.
138+
139+
1. Under **API (Enable OAuth Settings)**, ensure the **Manage user data via APIs (api)** is selected in the **Selected OAuth Scopes** list. If it's not selected, check if the setting is changed manually by mistake. If yes, revert the changes.
140+
141+
> [!NOTE]
142+
> If the **Manage user data via APIs (api)** isn't selected, the connected app can't access Salesforce data.
143+
144+
## Trouble connecting to Salesforce
145+
146+
### Symptoms
147+
148+
When a user tries to access Salesforce with the server-to-server flow, the following error message occurs:
149+
150+
> Trouble connecting to Salesforce.
151+
152+
You might also see the following message:
153+
154+
> Couldn't get Client ID for access token retrieval from Salesforce. The connected app might be misconfigured.
155+
156+
### Cause
157+
158+
This error occurs when the client ID of the Salesforce connected app is invalid. During the server-to-server flow setup, a connected app is deployed in Salesforce and linked to an integration user. The access token is retrieved using the client ID and secret of this app. If the client ID is missing or incorrect, authentication fails.
159+
160+
### Resolution
161+
162+
To resolve this issue, contact [Microsoft support](/microsoft-sales-copilot/get-support) and provide the following information:
163+
164+
- Whether the "Copilot for Sales Connected App" connected app is deleted accidentally.
165+
- If the connected app is still available, provide its ID.
166+
167+
## Try again
168+
169+
### Symptoms
170+
171+
As an administrator, when you try to set up the server-to-server flow for Salesforce, you might receive one of the following error messages:
172+
173+
- > Try again.
174+
- > This might be a temporary error. Try again. If it doesn't work, check back in 5-10 minutes.
175+
176+
### Cause
177+
178+
When you set up the server-to-server flow for Salesforce, the system attempts to establish a connection with Salesforce. During the setup, you might run into a few temporary issues.
179+
180+
### Resolution
181+
182+
To resolve this issue, wait for a few minutes and then try again. If the issue persists, gather the error details and contact [Microsoft support](/microsoft-sales-copilot/get-support).
183+
184+
## Unauthorized access denied
185+
186+
### Symptoms
187+
188+
When a user tries to access Salesforce with the server-to-server flow, the following error message occurs:
189+
190+
> Unauthorized access denied.
191+
192+
You might also see the following message:
193+
194+
> Access token expired or invalid. Try saving again to refresh it.
195+
196+
### Cause
197+
198+
The access token used for authentication is expired or invalid.
199+
200+
### Resolution
201+
202+
To resolve this issue, try again after 10 to 15 minutes. If this issue persists, check with your administrator to confirm if the connection is still active.
203+
204+
## More information
205+
206+
If your issue is still unresolved, go to the [Copilot for Sales - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/viva-sales/bd-p/VivaSales) to engage with our experts.
207+
208+
[!INCLUDE [Third-party disclaimer](../../includes/third-party-disclaimer.md)]

‎support/sales-copilot/toc.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
- name: CRM permissions and configurations
44
items:
55
- name: '"Align missing fields" error'
6-
href: crm-permissions-and-configurations/align-missing-fields-error.md
6+
href: crm-permissions-and-configurations/align-missing-fields-error.md
77
- name: Can't update records due to missing record access in Salesforce CRM
88
href: crm-permissions-and-configurations/missing-record-update-edit-access.md
99
- name: Can't update records due to missing object access in Salesforce CRM
@@ -12,6 +12,8 @@
1212
href: crm-permissions-and-configurations/update-settings-to-save-emails-error.md
1313
- name: Can't save email to CRM if enhanced email isn't enabled in Salesforce CRM
1414
href: crm-permissions-and-configurations/update-settings-in-saleforce-error.md
15+
- name: Errors when accessing Salesforce with server-to-server flow
16+
href: crm-permissions-and-configurations/errors-when-accessing-salesforce-with-server-to-server-flow.md
1517
- name: Errors when disabling Salesforce with server-to-server flow
1618
href: crm-permissions-and-configurations/errors-disabling-salesforce-server-to-server-flow.md
1719
- name: Errors when enabling Salesforce with server-to-server flow

0 commit comments

Comments
 (0)