On multi-tenant setups, all URLs shown on "Event Details"->"Assets" will not work.
Reason: While the workflow is running, the URLs point to the working file repository of the default tenant. But since the user of a given tenant is not logged in on the default tenant (and is not allowed to do so), the user is not authenticated on that tenant and implicitly not authorized to access files there.
This is not a problem for assets that have been archived since for those assets, a tenant-specific URL is used.
The problem can be solved by using tenant-specific URLs for the working file repository, too.