[TDiblik]

hi ^^, limited knowledge as well, however I'm pretty sure the issue is that Harvest allows all urls to be used as callback urls. You should tell microsoft to allow only certain urls as callbacks. eg, when setting up the workflow, they probably used a wildcard as an allow list of callback urls, instead of creating an actual list of trusted callback urls. I think that's what's happening here, could be totally wrong tho :D