Cannot approve new API permission request from SPFx package

[5erban]

Category

• Question
• Typo
• Bug
• Additional article idea

Expected or Desired Behavior

After I deploy an SPFx package, the API permission request show up in the API management section in the SharePoint Admin Center. I can approve/reject permission requests.

Observed Behavior

I cannot approve a request to Microsoft Graph - Directory.Read.All with error: [HTTP]:500 - [CorrelationId]:b7abd59e-a0db-8000-83b7-f367cdfa34d8 [Version]:16.0.0.8810 - Permission entry already exists.

In reality, the permission entry does not exist. I cannot see it in either the UI or using PowerShell.

Steps to Reproduce

Not sure how this can be reproduced. For other permission requests this used to work. The app was deployed on a site collection App Catalog (not the tenant App Catalog). Maybe this has something to do with it?

[msft-github-bot]

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

@5erban we believe this issue is resolved. Please open a new issue if you're still seeing this behavior.

[5erban]

Unfortunately, this problem still persists on our tenant

[westleyMS]

You do have to remove apps manually sometimes, after hitting this issue.
To enumerate them, you can use powershell this way-

#Requires -Modules AzureAD
$outPath = "c:\temp\azureADApps_SvcPrinc.txt"

if($creds -eq $null){
$creds = Get-Credential -Message "enter username and password for office Azure tenant: "
}
Connect-AzureAD -Credential $creds |Out-Null

"App Registrations:"| Out-File $outPath
Get-AzureADApplication | Out-File $outPath -Append

"rnApp Principals:"| Out-File $outPath -Append
Get-AzureADServicePrincipal -All:$true |Where-Object -FilterScript { ($.DisplayName -notlike "Microsoft") -and ($.DisplayName -notlike "autohost*") -and ($_.ServicePrincipalNames -notlike "localhost") } | Out-File $outPath -Append

&notepad.exe $outPath

Disconnect-AzureAD

Once you identify the app and/or service principal, you can remove them using Remove-AzureADServicePrincipal or Remove-AzureADApplication with the appropriate ObjectId to remove the problem entries. Apps registered on your tenant will have a service principal associated with them, so remove that first, then the app. If you trusted a multi-tenant app, it will just show the service principal. Make sure to use ObjectId when removing them.

[msft-github-bot]

Issues that have been closed & had no follow-up activity for at least 7 days are automatically locked. Please refer to our wiki for more details, including how to remediate this action if you feel this was done prematurely or in error: Issue List: Our approach to locked issues