When a guest user in your Microsoft Teams environment tries to run a flow from the Workflow app, the flow may fail to start or return an error. This typically happens because the guest user lacks the required licenses, permissions, or data policy assignments. In this article, you will learn the root causes behind this failure and the step-by-step fixes to allow guest users to run flows successfully.
Key Takeaways: Resolve Guest Flow Execution Failures in Teams Workflow
- Power Automate per-user plan: Assign a license to the guest user to enable flow execution.
- Teams admin center > Users > Guest users > Policies: Grant the guest user permission to create and run flows in Teams.
- Data loss prevention (DLP) policy: Ensure the flow does not violate tenant DLP rules that block guest access.
Why Teams Workflow App Blocks Guest Users from Running Flows
The Teams Workflow app relies on Power Automate to execute flows. Guest users, by default, have restricted permissions in Power Automate. They cannot create or run flows unless the tenant admin explicitly enables guest access. Additionally, each flow requires a license. Guest users must have a Power Automate per-user plan or a Microsoft 365 license that includes Power Automate capabilities. Without the license, the flow will not run.
Another common cause is the data loss prevention policy. DLP policies in Power Automate control which connectors and data can be used. If a DLP policy blocks guest users from using certain connectors, the flow will fail. The guest user also needs the correct role in the environment where the flow is stored. By default, guests have the Environment Maker role, but this may be disabled by the admin.
Guest User Permissions in Power Automate
In Power Automate, guest users are added to the tenant through Azure AD. Their access is controlled by the environment security settings. The admin can allow or block guest users from creating and running flows. If the setting “Allow guest users to be Environment Maker” is turned off, the guest cannot run any flow.
Steps to Diagnose and Fix Guest Flow Execution Issues
- Check the guest user’s license assignment
Go to the Microsoft 365 admin center. Select Users > Active users. Find the guest user and open their account. Under Licenses and apps, verify that a Power Automate per-user plan or a Microsoft 365 license with Power Automate is assigned. If not, assign one and wait 30 minutes. - Enable guest users to create flows in Power Automate
Sign in to Power Automate admin center. Go to Environments. Select the environment where the flow is located. Open Settings. Under Environment security, turn on “Allow guest users to be Environment Maker”. Save the change. - Verify the guest user’s security role
In the same environment settings, click Security groups. Ensure the guest user’s security group is added. If the guest is not in any group, add them to the appropriate security group that has Environment Maker permissions. - Check the flow’s owner and sharing
In Teams Workflow, open the flow that the guest cannot run. Click the flow name to open Power Automate. Under Owners, verify that the guest user is listed as a co-owner. If not, add them as a co-owner. Only owners can run a flow that is not shared. - Review data loss prevention policies
In the Power Automate admin center, go to Data policies. Select the default policy. Check if the connectors used in the flow are allowed. If a connector is blocked, either change the policy to allow it for guests or modify the flow to use a permitted connector. - Test the flow as the guest user
Ask the guest to sign in to Teams and open the Workflow app. Have them select the flow and click Run. If an error appears, note the exact error message. Common errors like “Flow not found” or “You do not have permission” point to sharing or role issues.
If the Flow Still Fails for the Guest User
Guest User Sees “You don’t have permission to run this flow”
This error means the guest is not a co-owner and the flow is not shared with them. Open the flow in Power Automate, go to Share, and add the guest as a co-owner. Also check that the guest’s email address is correctly spelled in the sharing dialog.
Flow Runs but Fails on a Connector
If the flow starts but a step fails, the connector may require a connection that the guest cannot authenticate. Ask the guest to open the flow and sign in to each connector. Some connectors, like SharePoint, may require the guest to have access to the site. Verify that the guest has the necessary permissions on the SharePoint site or other data sources.
Guest User Cannot See the Flow in Teams Workflow
If the flow is not visible, the guest may not be added to the correct team channel. In the Workflow app, flows are associated with a specific team and channel. Ensure the guest is a member of that team. Also, check that the flow is not set to “Private” visibility.
Power Automate Per-User Plan vs Microsoft 365 License for Guests
| Item | Power Automate Per-User Plan | Microsoft 365 License |
|---|---|---|
| Cost | Approximately $15 per user per month | Included in most Microsoft 365 plans |
| Flow limits | Unlimited runs with standard connectors | Limited to 2,000 runs per month |
| Guest eligibility | Can be assigned to guest users | Can be assigned to guest users |
| Premium connectors | Included | Not included |
After completing these steps, the guest user should be able to run flows in the Teams Workflow app. If the issue persists, check the Power Automate admin logs for detailed error codes. For advanced scenarios, consider creating a dedicated environment for guests to avoid policy conflicts. Remember to test with a sample flow after each change to isolate the cause.