SharePoint / SharePoint/sp-dev-docs

Sharepoint Admin API Access page: "Error ensuring domain-wide principals"

Open
#9,672 31 comments 0 reactions 1 assignee View on GitHub

@Amey-MSFT is already working on this.

Since May 26, 2025.

type:bug-confirmed
Dominant language
PowerShell
Stars
1.4k
Forks
1.1k
Avg merge
4d 12h
Merged PRs (30d)
12

Description

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

Windows

What browser(s) / client(s) have you tested
  • 💥 Internet Explorer
  • 💥 Microsoft Edge
  • 💥 Google Chrome
  • 💥 FireFox
  • 💥 Safari
  • mobile (iOS/iPadOS)
  • mobile (Android)
  • not applicable
  • other (enter in the "Additional environment details" area below)
Additional environment details
  • browser version
  • SPFx version
  • Node.js version
  • etc
Describe the bug / error

I've uploaded an spfx app to the app catalog with Microsoft Graph permissions requested in package-solution.json. The app was uploaded successfully, but when I visit the Sharepoint Admin API Access page, the permission request does not load and I see the following error:

Error ensuring domain-wide principals: The application identifier uri 'api://148ec9e1-128a-4017-afd9-449afa449006/microsoft.spfx3rdparty.com' is invalid.

This is the first time I have uploaded an app that requests Microsoft Graph permissions. I believe the API Access page is trying to create a new App Registration for an app called "SharePoint Online Client Extensibility Web Application Principal". I can see it make a failed network request to "https://graph.microsoft.com/beta/applications/". It sends two identifierUris in the payload. One is the one from the error above, and one has my organisation's tenant ID and sharepoint domain. The ID 148ec9e1-128a-4017-afd9-449afa449006 from the error is not my tenant ID. I am logged in as a global administrator.

Steps to reproduce
  1. Upload an app to the App Catalog that requires Microsoft Graph permissions for the first time
  2. Go to the Sharepoint Admin Center API Access page
Expected behavior

The Microsoft Graph permission request for the app loads and can be approved.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.