Unable to approve SharePoint API Permissions: "Access can't be approved because you didn't accept the requested permissions"

[Encodian]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• All tested browsers (latest versions)
• SPFx version: 1.17.1
• Node.js version: 16.20.0

Describe the bug / error

In the past week or so (not sure exactly when) an App package which has previously installed without issues has stopped working. After adding the App to the App Catalog, we are unable to approve any API permissions. After clicking 'Approve' the following error is displayed as opposed to the pop-up to consent to the requested permissions:

We have tested this in multiple M365 tenants... so something must have changed in M365?

Steps to reproduce

NOTE: The app package has been installed into 100's of tenants since May 24. The app package has not changed since this date.

App Permissions are set in the "webApiPermissionRequests" array within the pakage-solution.json, example:

The following permissions are contained:

• "resource": "Windows Azure Active Directory" - "scope": "User.Read"
• "resource": "" - "scope": "user_impersonation",
• "resource": "Microsoft Graph" - "scope": "Sites.FullControl.All"
• "resource": "Microsoft Graph" - TermStore.Read.All
• "resource": "Microsoft Graph" - User.Read

The reply URL is formed as follows:

https://login.microsoftonline.com/common/adminconsent?client_id=[clientId]&redirect_uri=[staticHtmlPage]

The reply URl's are all present within web section of the app registration within Entra

Expected behavior

On clicking 'Approve' on a pending 'API Access' request, we should be able to consent to requested permissions

Any ideas what has changed which means we not receive the reported error?

[ChetanSharma-msft]

Hello @Encodian - Thanks for raising your query.
We will look into it and let you know the updates.

[Ashlesha-MSFT]

@Encodian,
We able to approve the request after clicking "Approve"
Have you added like this?

[SteveSPAdditions]

We have the same issue with an app listed on AppSource that has not changed and, until now, has always Approved successfully. The SPFX SharePoint permissions in the manifest are just Sites.Selected as the id on an Enterprise App is also provided; the SPFx has to request at least one SharePoint permission itself. Any assistance resolving this much appreciated.

[Encodian]

@Encodian, We able to approve the request after clicking "Approve" Have you added like this?

Thank for the reply. Please refer to the screen shot originally provided and included below for completeness:

We are using SPFX 1.17.1 and have included both the "appId" and "replyUrl" properties. The reply URL is formed as follows:

https://login.microsoftonline.com/common/adminconsent?client_id=[clientId]&redirect_uri=[staticHtmlPage]

But as per @SteveSPAdditions ... this app package has been working without issue for months, so something external must have changed.

[SteveSPAdditions]

This issue seems to relate to the use of appId / replyUrl in the webApiPermissionRequests. Even when the permission in webApiPermissionRequests is aligned with the Enterprise Application it fails to Approve showing the error: Access can't be approved because you didn't accept the requested permissions"

Our app package was last successfully tested via the Partner Center on 20th February and has not changed since. It has been re-submitted for testing again today as they should hit the same error.

[Ashlesha-MSFT]

@Encodian,
We were able to get expected behavior i. e. Without any error permission got approved.

used same code which given by you in above image "webApiPermissionRequests": [
{
"resource": "Microsoft Graph",
"scope": "user.read"
},
{
"resource": "Microsoft Graph",
"scope": "Sites.FullControl.All",
"appId": "",
"replyUrl": "https://login.microsoftonline.com/common/adminconsent?client_id=&redirect_uri=[staticHtmlPage]"
},
{
"resource": "Microsoft Graph",
"scope": "TermStore.Read.All",
"appId": "",
"replyUrl": "https://login.microsoftonline.com/common/adminconsent?client_id=&redirect_uri=[staticHtmlPage]"
}
]
},

[SteveSPAdditions]

Thanks for the advice, but like you have suggested, only the permission without appId/replyUrl will approve:

[Ashlesha-MSFT]

@Encodian , @stevenjia I have tried with all the permission, but for my tenant its giving me expected behavior.

[Encodian]

@Ashlesha-MSFT - We removed all but one permission and the 'appId' and 'replyUrl' props, this works as expected see below:

We then readded the 'appId' and 'replyUrl' props which again failed with the same error:

We tried the following variations for the replyUrl prop:
https://login.microsoftonline.com/common/adminconsent?client_id=[clientId]&redirect_uri=[staticHtmlPage]
https://login.microsoftonline.com/common/adminconsent?client_id=[clientId]

What I don;t understand is that nothing in the affected packages has changed... which means something external has.

Have you tested your package using an Entra App which is setup to support 'Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)'?

Can you also share your complete 'replyUrl' omitting anything sensitive, and a screen shot of the authentication screen from the app registration please?