Sharepoint Admin API Access page: "Error ensuring domain-wide principals"

[sam-cormack]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• browser version
• SPFx version
• Node.js version
• etc

Describe the bug / error

I've uploaded an spfx app to the app catalog with Microsoft Graph permissions requested in package-solution.json. The app was uploaded successfully, but when I visit the Sharepoint Admin API Access page, the permission request does not load and I see the following error:

Error ensuring domain-wide principals: The application identifier uri 'api://148ec9e1-128a-4017-afd9-449afa449006/microsoft.spfx3rdparty.com' is invalid.

This is the first time I have uploaded an app that requests Microsoft Graph permissions. I believe the API Access page is trying to create a new App Registration for an app called "SharePoint Online Client Extensibility Web Application Principal". I can see it make a failed network request to "https://graph.microsoft.com/beta/applications/". It sends two identifierUris in the payload. One is the one from the error above, and one has my organisation's tenant ID and sharepoint domain. The ID 148ec9e1-128a-4017-afd9-449afa449006 from the error is not my tenant ID. I am logged in as a global administrator.

Steps to reproduce

1. Upload an app to the App Catalog that requires Microsoft Graph permissions for the first time
2. Go to the Sharepoint Admin Center API Access page

Expected behavior

The Microsoft Graph permission request for the app loads and can be approved.

[sam-cormack]

I am able to see the permission request via the PowerShell command Get-SPOTenantServicePrincipalPermissionRequests. There were a few other permissions requests from a third party app there too. I tried denying all the requests from Powershell to start fresh, but I still get the same error from the Sharepoint API access page.

[jacobmessner]

We are having the same issue. Following for updates...

[TehHota]

Same here

[jgsanw]

Getting this same error in our tenant.

If I try to approve the app requests via PowerShell using the Get-SPOTenantServicePrincipalPermissionRequests and Approve-SPOTenantServicePrincipalPermissionRequest cmdlets, I get an error that says the service principal for the request could not be found.

[mrwoes]

Same problem here. Already in contact with microsoft fore 2 months.... No results...

[Yin-ko]

Same, follwing for updates.

[mrwoes]

Is there an update? Let me know :)

[Yin-ko]

I think we were all hoping you might supply the update. :)