SPOWebAppServicePrincipal stopped working

[cwdata]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint CSOM

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

CSOM Version: 16.1.25611.12000 (older versions show the same behaviour)

Describe the bug / error

The following C# code using CSOM did work for several years. Now it suddenly throws an 'unknown error' during runtime:

using (ClientContext adminContext = this.authenticationManager.GetContext(this.spAdminUrl))
{
    var servicePrincipal = new SPOWebAppServicePrincipal(adminContext);
    var permissionGrants = servicePrincipal.PermissionGrants;
    var permissionRequests = servicePrincipal.PermissionRequests;
    adminContext.Load(permissionRequests);
    adminContext.Load(permissionGrants);
    adminContext.ExecuteQueryRetry();
}

Steps to reproduce

1. Get an access Token for an admin user (Global Admin or SharePoint Admin)
2. Initialize AuthenticationManager with that access token
3. Execute the code in the description above

Expected behavior

The execution should return pending requests and already approved grants.
But it only throws an 'unknown error':
Microsoft.SharePoint.Client.ServerException: Unbekannter Fehler. at Microsoft.SharePoint.Client.ClientRequest.ProcessResponseStream(Stream responseStream) at Microsoft.SharePoint.Client.ClientRequest.ProcessResponse() at Microsoft.SharePoint.Client.ClientRequest.<ExecuteQueryToServerAsync>d__53.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientRequest.<ExecuteQueryAsync>d__39.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientRuntimeContext.<ExecuteQueryAsync>d__65.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientContext.<ExecuteQueryAsync>d__28.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Microsoft.SharePoint.Client.ClientContextExtensions.<ExecuteQueryImplementation>d__6.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.SharePoint.Client.ClientContextExtensions.ExecuteQueryRetry(ClientRuntimeContext clientContext, Int32 retryCount, String userAgent)
Maybe this is related to the changes made for issue #9962

[Ashlesha-MSFT]

Hello @cwdata,
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[Ashlesha-MSFT]

@cwdata,
Can you please provide auth code because I tried with many ways to authenticate.
Below is the code which I am using

    public static void GetPermissionGrants()
    {
        // Your SharePoint Admin URL
        string spAdminUrl = "https://<<tenant name>>-admin.sharepoint.com/_api/";  // Replace with your SharePoint Admin URL

        // Your access token, which should already be obtained through OAuth2 (app-only token)
        string accessToken = "<your-access-token>"; // Replace with your actual access token

        // Use ClientContext to authenticate with the provided access token
        using (ClientContext adminContext = new ClientContext(spAdminUrl))
        {
            // Set the authentication header with the provided access token
            adminContext.ExecutingWebRequest += (sender, e) =>
            {
                e.WebRequestExecutor.WebRequest.Headers["Authorization"] = "Bearer " + accessToken;
            };

            try
            {
                // Create an instance of the service principal for SharePoint
                var servicePrincipal = new SPOWebAppServicePrincipal(adminContext);

                // Load the PermissionGrants and PermissionRequests objects
                var permissionGrants = servicePrincipal.PermissionGrants;
                var permissionRequests = servicePrincipal.PermissionRequests;

                // Load data for both permission grants and requests
                adminContext.Load(permissionRequests);
                adminContext.Load(permissionGrants);

                // Execute the query to SharePoint
                adminContext.ExecuteQuery();

                // Optionally, print or inspect the result
                Console.WriteLine("Permissions loaded successfully.");
            }
            catch (Exception ex)
            {
                // Output any errors (e.g., 401 Unauthorized) to help debug
                Console.WriteLine($"Error: {ex.Message}");
            }
        }
    }
}

[cwdata]

Hi Ashlesha, you could use this code:

using Microsoft.Identity.Client;
using Microsoft.Identity.Client.Extensions.Msal;
using Microsoft.Online.SharePoint.TenantAdministration.Internal;
using Microsoft.SharePoint.Client;

Console.WriteLine("Retrieving permissions...");

// Adjust this section to your environment
string spAdminUrl = "https://<<TenantName>>-admin.sharepoint.com";
string[] scopes = new string[] { "https://<<TenantName>>.sharepoint.com/AllSites.FullControl" };
string clientId = "<<ClientId of your EntraID App Registration>>";
string tenantId = "<<TenantId of your EntraID Tenant>>";
// --------------------------------------------

var app = PublicClientApplicationBuilder.Create(clientId)
    .WithDefaultRedirectUri()
    .WithTenantId(tenantId)
    .Build();

var storageProperties = new StorageCreationPropertiesBuilder("tokencache", ".\\").Build();
var cacheHelper = await MsalCacheHelper.CreateAsync(storageProperties);
cacheHelper.RegisterCache(app.UserTokenCache);

var accounts = await app.GetAccountsAsync();

AuthenticationResult result;
try
{
    result = await app.AcquireTokenSilent(scopes, accounts.FirstOrDefault())
      .ExecuteAsync();
}
catch (MsalUiRequiredException)
{
    result = await app.AcquireTokenInteractive(scopes).ExecuteAsync();
}

using (ClientContext adminContext = new ClientContext(spAdminUrl))
{
    // Set the authentication header with the provided access token
    adminContext.ExecutingWebRequest += (sender, e) =>
    {
        e.WebRequestExecutor.WebRequest.Headers["Authorization"] = "Bearer " + result.AccessToken;
    };

    try
    {
        // Create an instance of the service principal for SharePoint
        var servicePrincipal = new SPOWebAppServicePrincipal(adminContext);

        // Load the PermissionGrants and PermissionRequests objects
        var permissionGrants = servicePrincipal.PermissionGrants;
        var permissionRequests = servicePrincipal.PermissionRequests;

        // Load data for both permission grants and requests
        adminContext.Load(permissionRequests);
        adminContext.Load(permissionGrants);

        // Execute the query to SharePoint
        adminContext.ExecuteQuery();  // This line will throw the error

        // Optionally, print or inspect the result
        Console.WriteLine("Permissions loaded successfully.");
    }
    catch (Exception ex)
    {
        // Output any errors (e.g., 401 Unauthorized) to help debug
        Console.WriteLine($"Error: {ex.ToString()}");
    }
}

You'll also need to create an app registration in EntraID with the SharePoint permissions 'AllSites.FullControl' (delegated). This app also needs to allow the public client flow and must have the reply urls for mobile and desktop apps.