Microsoft Graph App Manifest (New)

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

None

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

Tenants with new Microsoft Graph App Manifest (New)

Describe the bug / error

I have one customer tenant which has the new Microsoft Graph App Manifest tab in the Entra App Registration Manifest page. Apparently this was released in June 2024 but I've only seen it on one tenant out of 50 so far. (https://learn.microsoft.com/en-us/entra/identity-platform/azure-active-directory-graph-app-manifest-deprecation)

This one tenant has a non-functioning Sharepoint API Management page. When an SPFx is uploaded, the permissions it requests from the Manifest appear here, and when approved each scope permissions appears in the approved list. However, the SharePoint Online Client Extensibility Web Application Principal does not get them added, and after refreshing the API management page they disappear. The only permission which does stick is user_impersonation for our own app, no Graph permissions apply.

We tried deleted the Client Extensibility principal which lead to a world of pain as the API management page couldn't rebuild it automatically. MS support have brought it back, but I'm not sure how successfully as the SPFx app is still scoping its token request to the old principal's app id.

I'm not sure what the issue is, but the only difference between 50 working tenants and this one is the appearance of the new MS Graph App Manifest tab.

Steps to reproduce

Upload an SPFx
Approve the requested permissions in the API management page
Refresh the page - the approved permissions have disappeared

Expected behavior

The approved permissions should be added as API access to the SharePoint Online Client Extensibility Web Application Principal
The approved permissions should appear in the SharePoint API management page