Dynamics Community Forum Thread Details

Hi,

We are seeing an authentication failure in the Document Routing Agent (DRA) that is specific to guest user accounts, and would like the community's input on the underlying cause.

DRA version: 7.0.7996.81
Environment: D365 F&O Sandbox (QA)

Observed behavior:
- Signing into the DRA with a native tenant account succeeds with no errors.
- Signing into the DRA with a guest account (from a partner/external tenant) fails with: "Agent could not connect to Microsoft Dynamics 365 for Finance and Operations. Agent version check failed."
- This is the same DRA build in both cases, on the same environment, tested within the same session.
- The guest account holds the System Administrator role in this D365 F&O environment, ruling out a security role assignment gap (e.g. "Document routing client" role, which System Administrator encompasses).
- Standard D365 F&O browser access via this guest account works normally with no sign-in issues.

Our working theory is that the "version check failed" message is masking an underlying authentication/token failure specific to guest (B2B) accounts - potentially related to Conditional Access policy scoping, guest consent, or token exchange behaviour that differs between guest and native accounts during the DRA's Entra ID sign-in flow, rather than an actual DRA version mismatch.

Has anyone else run into this? Specifically interested in:
1. Whether the DRA's Entra ID authentication flow is known to behave differently for guest vs. member accounts, and what token/consent requirements apply specifically to guest sign-in.
2. Whether "Agent version check failed" can be triggered by an authentication failure rather than an actual agent/environment version mismatch, and how to distinguish the two.
3. Any recommended configuration (e.g. Conditional Access exclusions, guest consent settings) to support guest account sign-in to the DRA.

Thanks in advance.