SPOWebAppServicePrincipal stopped working

[cwdata]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint CSOM

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

CSOM Version: 16.1.25611.12000 (older versions show the same behaviour)

Describe the bug / error

The following C# code using CSOM did work for several years. Now it suddenly throws an 'unknown error' during runtime:

using (ClientContext adminContext = this.authenticationManager.GetContext(this.spAdminUrl))
{
    var servicePrincipal = new SPOWebAppServicePrincipal(adminContext);
    var permissionGrants = servicePrincipal.PermissionGrants;
    var permissionRequests = servicePrincipal.PermissionRequests;
    adminContext.Load(permissionRequests);
    adminContext.Load(permissionGrants);
    adminContext.ExecuteQueryRetry();
}

Steps to reproduce

1. Get an access Token for an admin user (Global Admin or SharePoint Admin)
2. Initialize AuthenticationManager with that access token
3. Execute the code in the description above

Expected behavior

The execution should return pending requests and already approved grants.
But it only throws an 'unknown error':
Microsoft.SharePoint.Client.ServerException: Unbekannter Fehler. at Microsoft.SharePoint.Client.ClientRequest.ProcessResponseStream(Stream responseStream) at Microsoft.SharePoint.Client.ClientRequest.ProcessResponse() at Microsoft.SharePoint.Client.ClientRequest.<ExecuteQueryToServerAsync>d__53.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientRequest.<ExecuteQueryAsync>d__39.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientRuntimeContext.<ExecuteQueryAsync>d__65.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientContext.<ExecuteQueryAsync>d__28.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Microsoft.SharePoint.Client.ClientContextExtensions.<ExecuteQueryImplementation>d__6.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientContextExtensions.ExecuteQueryRetry(ClientRuntimeContext clientContext, Int32 retryCount, String userAgent)
Maybe this is related to the changes made for issue #9962

[Ashlesha-MSFT]

Hello @cwdata,
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[Ashlesha-MSFT]

@cwdata,
Can you please provide auth code because I tried with many ways to authenticate.
Below is the code which I am using

    public static void GetPermissionGrants()
    {
        // Your SharePoint Admin URL
        string spAdminUrl = "https://<<tenant name>>-admin.sharepoint.com/_api/";  // Replace with your SharePoint Admin URL

        // Your access token, which should already be obtained through OAuth2 (app-only token)
        string accessToken = "<your-access-token>"; // Replace with your actual access token

        // Use ClientContext to authenticate with the provided access token
        using (ClientContext adminContext = new ClientContext(spAdminUrl))
        {
            // Set the authentication header with the provided access token
            adminContext.ExecutingWebRequest += (sender, e) =>
            {
                e.WebRequestExecutor.WebRequest.Headers["Authorization"] = "Bearer " + accessToken;
            };

            try
            {
                // Create an instance of the service principal for SharePoint
                var servicePrincipal = new SPOWebAppServicePrincipal(adminContext);

                // Load the PermissionGrants and PermissionRequests objects
                var permissionGrants = servicePrincipal.PermissionGrants;
                var permissionRequests = servicePrincipal.PermissionRequests;

                // Load data for both permission grants and requests
                adminContext.Load(permissionRequests);
                adminContext.Load(permissionGrants);

                // Execute the query to SharePoint
                adminContext.ExecuteQuery();

                // Optionally, print or inspect the result
                Console.WriteLine("Permissions loaded successfully.");
            }
            catch (Exception ex)
            {
                // Output any errors (e.g., 401 Unauthorized) to help debug
                Console.WriteLine($"Error: {ex.Message}");
            }
        }
    }
}

[cwdata]

Hi Ashlesha, you could use this code:

using Microsoft.Identity.Client;
using Microsoft.Identity.Client.Extensions.Msal;
using Microsoft.Online.SharePoint.TenantAdministration.Internal;
using Microsoft.SharePoint.Client;

Console.WriteLine("Retrieving permissions...");

// Adjust this section to your environment
string spAdminUrl = "https://<<TenantName>>-admin.sharepoint.com";
string[] scopes = new string[] { "https://<<TenantName>>.sharepoint.com/AllSites.FullControl" };
string clientId = "<<ClientId of your EntraID App Registration>>";
string tenantId = "<<TenantId of your EntraID Tenant>>";
// --------------------------------------------

var app = PublicClientApplicationBuilder.Create(clientId)
    .WithDefaultRedirectUri()
    .WithTenantId(tenantId)
    .Build();

var storageProperties = new StorageCreationPropertiesBuilder("tokencache", ".\\").Build();
var cacheHelper = await MsalCacheHelper.CreateAsync(storageProperties);
cacheHelper.RegisterCache(app.UserTokenCache);

var accounts = await app.GetAccountsAsync();

AuthenticationResult result;
try
{
    result = await app.AcquireTokenSilent(scopes, accounts.FirstOrDefault())
      .ExecuteAsync();
}
catch (MsalUiRequiredException)
{
    result = await app.AcquireTokenInteractive(scopes).ExecuteAsync();
}

using (ClientContext adminContext = new ClientContext(spAdminUrl))
{
    // Set the authentication header with the provided access token
    adminContext.ExecutingWebRequest += (sender, e) =>
    {
        e.WebRequestExecutor.WebRequest.Headers["Authorization"] = "Bearer " + result.AccessToken;
    };

    try
    {
        // Create an instance of the service principal for SharePoint
        var servicePrincipal = new SPOWebAppServicePrincipal(adminContext);

        // Load the PermissionGrants and PermissionRequests objects
        var permissionGrants = servicePrincipal.PermissionGrants;
        var permissionRequests = servicePrincipal.PermissionRequests;

        // Load data for both permission grants and requests
        adminContext.Load(permissionRequests);
        adminContext.Load(permissionGrants);

        // Execute the query to SharePoint
        adminContext.ExecuteQuery();  // This line will throw the error

        // Optionally, print or inspect the result
        Console.WriteLine("Permissions loaded successfully.");
    }
    catch (Exception ex)
    {
        // Output any errors (e.g., 401 Unauthorized) to help debug
        Console.WriteLine($"Error: {ex.ToString()}");
    }
}

You'll also need to create an app registration in EntraID with the SharePoint permissions 'AllSites.FullControl' (delegated). This app also needs to allow the public client flow and must have the reply urls for mobile and desktop apps.

[Ashlesha-MSFT]

@cwdata,
Thanks for your help with the code. However, I’m still unable to reproduce the expected behavior. Here are the scenarios I’ve tested:

• When I include the scope AllSites.FullControl, I receive the following error indicating an invalid scope:

Retrieving permissions... Token acquisition failed: MSAL.NetCore.4.74.1.0.MsalServiceException: ErrorCode: invalid_scope Microsoft.Identity.Client.MsalServiceException: AADSTS1002012: The provided value for scope https://tenant.sharepoint.com/AllSites.FullControl is not valid.

• When I switch to using the .default scope, I encounter a 401 Unauthorized error, despite having granted the required permissions as shown in the screenshots below.

Could you please advise on what might be causing these issues or if there are additional configurations needed to properly acquire tokens with these scopes?

[cwdata]

@Ashlesha-MSFT
if your Tenant is named "contoso.sharepoint.com", you must put this name into the variables at the top of the script:

string spAdminUrl = "https://contoso-admin.sharepoint.com";
string[] scopes = new string[] { "https://contoso.sharepoint.com/AllSites.FullControl" };

And the Ids for the tenant and the app-registration have to be correct too. You can also use "/.default" instead of "/AllSites.FullControl". That makes no difference. You don't need any Microsoft Graph permissions in your app registration.

[Ashlesha-MSFT]

@cwdata,
Thanks for your response and input. However, based on our understanding, the way the permissions are being configured may not be fully aligned with the recommended approach.

Using /.default vs. /AllSites.FullControl can have implications depending on the scopes granted during app registration and consent. Also, while Graph permissions aren't always required, it depends on the specific operations being performed. It might be worth double-checking the setup to ensure it's consistent with best practices for app-only access.

Additionally, this issue appears to be more related to the PnP-Sites-Core library, so I’d recommend raising it in the following repo for more targeted support:
https://github.com/pnp/PnP-Sites-Core/issues

Apologies for the redirect, but that team will be better positioned to help with this scenario.

Thanks again!