Cannot add site collection app catalog as SharePoint Admin role

[quarterhorse]

Thank you for reporting an issue or suggesting an enhancement. We appreciate your feedback - to help the team to understand your needs, please complete the below template to ensure we have the necessary details to assist you.

Category

• Question
• Typo
• Bug
• Additional article idea

If you are planning to share a new feature request (enhancement / suggestion), please use SP Dev UserVoice at http://aka.ms/sp-dev-uservoice.

Expected or Desired Behavior

A user with the SharePoint Administration role should be able to add a site collection app catalog through add-spositecollectionappcatalog as a site collection administrator.

Observed Behavior

The cmdlet generates the error "Must have Manage Web Site permissions or be a tenant admin in order to add or remove sites from the site collection app catalog allow list"

add-spositecollectionappcatalog : Must have Manage Web Site permissions or be a tenant admin in order to add or remove sites from the site collection app catalog allow list

At line:1 char:1

• add-spositecollectionappcatalog -site

•   + CategoryInfo          : NotSpecified: (:) [Add-SPOSiteCollectionAppCatalog], ServerException
    + FullyQualifiedErrorId : Microsoft.SharePoint.Client.ServerException,Microsoft.Online.SharePoint.PowerShell.AddSiteCollectionAppCatalog
  
  

Steps to Reproduce

• An existing on-premise active directory account is synchronized to azure ad.
• The active directory account is granted the SharePoint Administrator role.
• The user logs into the SharePoint Administration center with the account having the assigned role
• The user provisions a publishing site collection with the user as the site collection administrator (verified by see the SharePoint Administrator account in the site collection administrators list in the resultant Site Collection).
• Open the SharePoint Online Management Shell (version 16.0.7317.1200).
• Connect to sposervice.
• Execute add-spositecollectionappcatalog -site

[VesaJuvonen]

Hi @quarterhorse - this is actually by-design for now. You can certainly submit a user voice entry to start collecting the demand for change the behavior.

[sympmarc]

@VesaJuvonen: I'm getting the same error. The message feels a little misleading. I'm trying to create a Site Collection App Catalog, and I'm a Site Collection Administrator. Clearly that gives me "Manage Web Site permissions" - on the Site Collection where I am trying to create the App Catalog. Should I assume the permissions part of the error applies to the Tenant App Catalog site?

[cathornton]

Hi, firstly, I can't see how you were able to dismiss this as "By Design" when the steps taken should have worked OK.
But anyway, I had this same error and finally found the issue: the part of the error "Must have Manage Web Site permissions" actually relates to the App Catalog site collection, not to the site you are adding to the App Catalog.
Add your account as Site Collection Admin to the App Catalog, and it should go through.

[sparkitect]

I can verify that making your account a Site Collection Administrator on the tenant App Catalog Site Collection makes it possible to create a Site Collection App Catalog using the method described in the documentation.

Perhaps the following note could be added to said documentation:
NOTE: The account used to execute these commands must be a Site Collection Administrator on both the tenant-level App Catalog and the target Site Collection.

[JBoman32768]

Confirmed - it doesn't matter if you are a Global Tenant Administrator, if you don't have site collection admin rights to the tenant level App Catalog, this will fail.

@VesaJuvonen - is this still by design?

[alirobe]

Thanks @JBoman32768. It would be nice if the error message was updated to let people know about this. Error message is quite unclear.

https://sharepoint.uservoice.com/forums/329220-sharepoint-dev-platform/suggestions/33321112-users-with-sharepoint-admin-roles-should-be-able-t

[JBoman32768]

The error message is actually quite clear - and incorrect, but somehow "by design"
"Must have Manage Web Site permissions or be a tenant admin in order to add or remove sites from the site collection app catalog allow list"
Both of these things are irrelevant.

[msft-github-bot]

Issues that have been closed & had no follow-up activity for at least 7 days are automatically locked. Please refer to our wiki for more details, including how to remediate this action if you feel this was done prematurely or in error: Issue List: Our approach to locked issues