Microsoft Graph Error When Trying to Provision Learning Pathways

[binarywhisperer84]

I am trying to provision the Learning Pathways solution from the Lookbook site (https://lookbook.microsoft.com/details/3df8bd55-b872-4c9d-88e3-6b2f05344239).

I am a global admin of my tenant and have site collection owner rights to the SharePoint app catalog. After clicking the "Add to your tenant" button on the SharePoint Lookbook site, I almost immediately receive the following error:

Sorry, something went wrong. There was an unexpected issue. Exception while invoking endpoint https://graph.microsoft.com/v1.0/sites/root.

I have tried provisioning this multiple times, in multiple browsers, using multiple accounts (one with MFA enabled and another without MFA enabled). I have tried deleting the "SharePointPnP.ProvisioningApp.Tenant" enterprise app in AAD and re-accepting the app permissions on behalf of my organization, but the process fails every time. I have been on the phone with Microsoft support personnel, shared screenshots and logs, and have done screen-sharing to repeat the steps, but the installation continues to fail. And I have also tried manually installing the app in SharePoint but to no avail.

[PaoloPia]

Hi @binarywhisperer84,
Thanks for using the Look Book site. It sounds like a permission issue with Microsoft Graph. Can I ask you to open, within the same user context where you are experiencing the issue, the Microsoft Graph Explorer tool (https://developer.microsoft.com/en-us/graph/graph-explorer) and try to execute the following request:

https://graph.microsoft.com/v1.0/sites/root

Does it work? Do you get an exception? Thanks.

[binarywhisperer84]

Sounds like you're on to something. It tells me "Access Denied" when I run the query. The error msg tells me I "need to consent to the permissions on the Modify permissions (Preview) tab," but even when I consent and re-run the query, I get the same msg. How can I resolve this permissions issue?  

…

________________________________ From: Paolo Pialorsi <notifications@github.com> Sent: Wednesday, March 10, 2021 11:39 AM To: SharePoint/sp-provisioning-service <sp-provisioning-service@noreply.github.com> Cc: Jason Curtis <curtis@oikosmail.com>; Mention <mention@noreply.github.com> Subject: Re: [SharePoint/sp-provisioning-service] Microsoft Graph Error When Trying to Provision Learning Pathways (#411) Hi @binarywhisperer84<https://github.com/binarywhisperer84>, Thanks for using the Look Book site. It sounds like a permission issue with Microsoft Graph. Can I ask you to open, within the same user context where you are experiencing the issue, the Microsoft Graph Explorer tool (https://developer.microsoft.com/en-us/graph/graph-explorer) and try to execute the following request: https://graph.microsoft.com/v1.0/sites/root Does it work? Do you get an exception? Thanks. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#411 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ATEMVOWW2SCIMDYVCYVG24LTC444XANCNFSM4YZQXRJA>.

[PaoloPia]

Thanks for taking the time to test it. Based on the evidence, I would suggest you to remove the "SharePointPnP.ProvisioningApp.Tenant" enterprise app from AAD and to re-consent it from scratch via the Look Book site. However, you said that you already did it, so I'm a bit clueless now ... do you mind trying one more time, being sure that you get the consent prompt and that you effectively consent to the app? Moreover, is there any custom policy at AAD level in your tenant (like Conditional Access, or something like that), that could eventually prohibit access to SPO from third party apps? Please, let me know. Thanks.

[binarywhisperer84]

I've tried removing the "SharePointPnP.ProvisioningApp.Tenant" enterprise app from AAD several times, including just a minute ago, but I still receive the error during provisioning after I consent to the app. We don't have any custom policies in Azure that would prevent access to SharePoint from third-party apps.

…

________________________________ From: Paolo Pialorsi ***@***.***> Sent: Wednesday, March 10, 2021 7:05 PM To: SharePoint/sp-provisioning-service ***@***.***> Cc: Jason Curtis ***@***.***>; Mention ***@***.***> Subject: Re: [SharePoint/sp-provisioning-service] Microsoft Graph Error When Trying to Provision Learning Pathways (#411) Thanks for taking the time to test it. Based on the evidence, I would suggest you to remove the "SharePointPnP.ProvisioningApp.Tenant" enterprise app from AAD and to re-consent it from scratch via the Look Book site. However, you said that you already did it, so I'm a bit clueless now ... do you mind trying one more time, being sure that you get the consent prompt and that you effectively consent to the app? Moreover, is there any custom policy at AAD level in your tenant (like Conditional Access, or something like that), that could eventually prohibit access to SPO from third party apps? Please, let me know. Thanks. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#411 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ATEMVOXZ6LVWA5QKUE6PKCDTC6RFLANCNFSM4YZQXRJA>.

[heyvoon]

Hello there! I am getting the same thing here trying to install the templates! I've followed the instructions here but the results are the same;

Any solution to this yet?

[glblinck]

Was there ever a resolution to this?

[glblinck]

Odd thing. Changing the site permissions to the home site got this working for me. The call to /sites/root would go to the home site, so this is what fixed the problem. If the installer doesn't have permission to the home site, this seems to be the failure. It's likely unusual as the home site would generally have everyone as site visitors, at least. But if the admin account doesn't have any permission to the home site, this seems to be how it fails.

[thomasjsweet]

I know this is closed but I got the error today. Mine appeared to be related to MFA. I logged out and logged back in again and it worked. Good news is that no reboot was required.

[gcflow]

I know this is closed but I got the error today. Mine appeared to be related to MFA. I logged out and logged back in again and it worked. Good news is that no reboot was required.

Thanks Thomas for leaving this solution on the site. Worked for me also, used private browser session to login which prompted for my MFA code and did not have any problems then.

[frerghost]

I can report that at 0449 Eastern, I received the same error message attempting to deploy Sharepoint Lookbook. Specifically, I was attempting to deploy the Employee Onboarding.

[rconiv]

Still an issue. I am a global admin, but still can't deploy it. Can't actually report the app either, since it gives an error.

Like others mentioned though, if I opened it in private mode in Edge Chromium, and go through login, password, MFA, it works fine, so there is some kind of odd permissions thing going on, I am guessing with Microsoft 2FA possibly.