Journey Builder Integration flows can fail when the critical update "Require User Access to Apex Classes Invoked by Flow" is activated
Trailblazer Community

Journey Builder Integration flows can fail when the critical update "Require User Access to Apex Classes Invoked by Flow" is activated

Flow , Marketing Cloud Integrations , Marketing Cloud Journey Builder

Last updated Today ·Reference W-6462765 ·Reported By 15 users

In Review

Summary
The Salesforce critical update, Require User Access to Apex Classes Invoked by Flow, can cause flows to fail and prevent the Journey Builder Integration (JB-INT) from injecting records into an active Journey in the Marketing Cloud. This can happen if this CRUC is enabled and your user profiles (or permission sets, etc) do not have access to the global Journey Builder classes in Salesforce.

Admins might need to adjust profiles or permission sets for users who run flows that invoke Apex classes. A flow stops working if it invokes an Apex class that the running user doesn’t have access to.


https://releasenotes.docs.salesforce.com/en-us/summer19/release-notes/rn_forcecom_flow_cruc_security.htm

Repro
1) In an ORG using the Journey Builder Integration, Enable Critical Update "Require User Access to Apex Classes Invoked by Flow"
2) Remove all of the et4ae5 namespaced classes from your User profile or permission sets
3) Create a Journey using the Salesforce Data Event and an entry object such as Contact
4) Create a new Contact that would be added to the journey
5) Observe errors in Salesforce similar to: Can't Save Record - We can't save this record because the "JBSystem_Contact_Process" process failed...
--this is not object specific but the error would be constructed as, JBSystem_<Object_Name>_Process
6) An admin may also receive an email with the error, Profile does not have access to: et4ae5__jbintfirebulkevent

Workaround
Admins will need to adjust profiles or permission sets for users who run flows that invoke Apex classes. A flow stops working if it invokes an Apex class that the running user doesn’t have access to. Your admin will need to grant access to the global Journey Builder Apex Class et4ae5.JBintFireBulkEvent.

Also, you can attempt to deactivate the CRUC "Require User Access to Apex Classes Invoked by Flow".

Any unreleased services, features, statuses, or dates referenced in this or other public statements are not currently available and may not be delivered on time or at all. Customers who purchase our services should make their purchase decisions based upon features that are currently available.