Adding Hosted Feature Layer to Pro: 403 Error

[MobiusSnake]

Hi all,

I'm working with two organizations who are sharing hosted feature layers via a group, I'll call them Org_A and Org_B.

Org_A has a group with a few hosted feature layers in it, some editable, some not.  An Org_B user with a Pro Basic license can access these layers through Survey123 forms and the web, and can see the layers in the Catalog pane of ArcGIS Pro.  However, when an Org_B user attempts to add these layers to a map in Pro they get the following message:

Failed to add data: (URL redacted)

ERROR: code 403, You do not have permissions to access this resource or perform this operation., You do not have permissions to access this resource or perform this operation., Access to this resource is forbidden, regardless of authorization.

Any ideas why would this user would not be allowed to add the data in Pro, although they can access it through the AGOL web interface, the REST Services Directory, etc.?  This occurs with all of the hosted feature layers in the group, it isn't limited to one specific layer.

Thanks!

[Robert_LeClair]

How is the user attempting to add the layer?  In the Catalog Pane via the Portal tab or by using the Add Data (Add Data from Path) dropdown on the Map tab, in the Layer Group?

[MobiusSnake]

This is via the Catalog pane, right-clicking the item to add it to the map.

[Robert_LeClair]

Thank you for the response - if you add the layer via Add Data->Add data from path, do you get the same error?

[MobiusSnake]

Yeah, unfortunately the same error message that way as well.  What's really interesting is that I can even explore the service's layers/tables from the Content pane, but if I try to add them I get the same error message (with the layer/table ID at the end of the URL, e.g. "/0").  I get the same error message trying to add individual layers or tables to Pro using the Add Data command from the toolbar.

Edit - One more thing, if I try to open the attribute tables of the layers/tables without adding them to the map, I get this message:

Failed to open table.

Error:
Error creating map member.

---

[ChelseaRozek]

Hey @MobiusSnake! It was nice to meet you at the MVP meeting yesterday. I'm running into this issue too, though my layer isn't hosted (published to our server, added as an item with saved credentials in AGO) Did you make any progress with it?

[MobiusSnake]

Hi Chelsea, we ended up using a File GDB export as a workaround (definitely not ideal but got us through the day), however since then I've had the same users access similar layers and never ran into the issue again so I figured it was a temporary hiccup in AGOL.

[Mark_Prettyman]

Ditto!  I found this posting just yesterday and subscribed to follow it.  I too am working with customers who cannot add a layer from AGOL to a map within Pro.  The layer in AGOL is originally published as a REST service that is secured with credentials, and registered as a layer in AGOL.  The layer sharing is set to "Organization" so any user in the org should be able to access it.  I can, but I am an admin.  I have tried on both my company's network, and my home network, successfully.

We recently updated to Enterprise 11.1 and have been wondering if that has any bearing.  What version is your Enterprise?

[ChelseaRozek]

Thanks for chiming in @Mark_Prettyman ! We're on 11.1. It's published to our unfederated ArcGIS Server. This sharing situation is new for us, so I can't say for certain if it worked before this version or not. Our AGO item is set to private + one group, no referrer url limiting. This group has users from another organization as members. I'm able to add the item fine into my own Pro via the group, but they cannot. I'm on the latest Pro. I'm reaching out to see which version of Pro they're on. They're on 3.1.2 & 3.2.

[Mark_Prettyman]

Thanks @ChelseaRozek !  Again, ditto!  This service is published to one of our unfederated ArcGIS servers.  The user that cannot access the data is on Pro 3.2.0.  I have successfully added the layer in Pro 3.1.3 and 3.2.0, though.  But, the user is from another company that has privileges to have an account in our org.  As in, it is still a named user account in our org, as opposed to a member from a collaboration org.  I am waiting for a response from a user from yet a totally different company with an account in our org to see if they can successfully add the same layer to a map in Pro.